Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

61–70 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#61

Post by tiborsaas »

lawtalkinghuman wrote: post #18
erklik wrote: post #6

Earlier quoted context omitted.

> I can not believe the motivation can simply be to get subtitles to watch movies personally Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?

> Does everything require a money motive? On HN, apparently. See the recent thread on Wordle. The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it. It is depressing that HN participants are so often mystified by the idea people might be motivate…

I think you massively underestimate how much ads can bring in with a high traffic website: https://www.similarweb.com/website/opensubtitles.org/

I'd guess about $1-3M/year from ads.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#62

Post by COGlory »

lillecarl wrote: post #13
PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use). BitWarden is open source, both server and clients. There's even a thir…

Is exporting your passwords and encrypting the file not an option for you?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#63

Post by stevewodil »

Aissen wrote: post #58

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

Slightly related, in order to prevent super long passwords from eating up CPU time is it better to hash using sha256 before argon/bcrypt so that the length is constant, or is it better to limit password length to some arbitrary number like 64 characters

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#64

Post by dabeledo »

Aissen wrote: post #58

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

> simply do bcrypt(md5(password))

This could also be problematic.

Password Shucking https://www.youtube.com/watch?v=OQD3qDYMyYQ

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#65

Post by korginator »

By now I assume that any service where I've registered for an account is being actively targeted and that any organisation that's not a Google, Microsoft or the likes has already been breached. MFA is your friend, and even plain vanilla SMS based MFA is better than just a username and password for authentication. I've enabled hardware based MFA anywhere it's supported.

15-20 years ago it was fun to sign up for dozens of new services and we reused passwords everywhere. Now every one of these accounts is a liability and a potential vector for bad things to happen. The worst case scenario is when an account of yours is breached and abused for a long time, possibly with legal and financial ramifications, and you don't find out until much later.

A couple of months ago I happened to glance at my Gmail's spam folder by chance, and one email way down the list immediately grabbed my attention. The subject line had *my password* for an old and unused account that I'd forgotten long back and the sender was trying to extort bitcoin if I wanted the account back.

The big issue is with online shopping. The sender has your name, address, email, phone number and possibly your CC number, a prime target for identity thieves.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#66

Post by asddubs »

Aissen wrote: post #58

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

for md5, you could also download some common password lists and rehash at least the ones you can "crack"

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#67

Post by dotancohen »

gwd wrote: post #49
tialaramex wrote: post #43

Earlier quoted context omitted.

Nobody is saying bcrypt isn't a good choice here, they're saying that rainbow tables (and all time-space trades) are made infeasible by salt regardless of whether you're using a good password hash like bcrypt.

But both you & GGP are talking about bcrypt as though it was only a password hash. If someone says, "I'm using bcrypt", then they are using both a password hash and unique per-password salts, or they're not using bcrypt. What makes bcrypt and other such systems nice (and makes this kind of mistake basically inexcusable in 2022) is that if you're using a library or package which implements it (which you should), you d…

This, _and_ bcrypt is slow. Many wrapping libraries' hashing functions accept an optional parameter to specify just how slow it should be.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#68

Post by k4rli »

johndoeee wrote: post #24
lawtalkinghuman wrote: post #18

Earlier quoted context omitted.

> Does everything require a money motive? On HN, apparently. See the recent thread on Wordle. The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it. It is depressing that HN participants are so often mystified by the idea people might be motivate…

> The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting Opensubtitles has a VIP program at $15 a year. It's quite easy to find the person who runs the site and, according to their CV, this is basically their job. That'd make Opensubtitles a for-profit piracy site, i guess.

Subtitles aren't piracy in any way though. Kind of similar to legality of torrent sites but even less questionable.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#69

Post by mpeg »

dabeledo wrote: post #64
Aissen wrote: post #58

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

> simply do bcrypt(md5(password)) This could also be problematic. Password Shucking https://www.youtube.com/watch?v=OQD3qDYMyYQ

Honestly, not as a big a deal as some people make it.

First off, you'd have to assume the attacker knows the bcrypt hashes are bcrypt(md5(password)) – an attacker wouldn't always know this

Also it assumes there is password reuse, but that the password is strong enough that the md5 is uncracked.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#70

Post by g19fanatic »

lillecarl wrote: post #13
PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use). BitWarden is open source, both server and clients. There's even a thir…

I use keepass with the app.keeweb.info frontend and a gdrive backend. keeweb.info has totp as well. Seems pretty straight forward and its free. Make the backend file accessible by link and forward a bit.ly to it and you can pull it down anywhere you have internet. Phone app works great too. Everything works offline too if gdrive isn't your thing

Every computer I normally use will have a copy of the file in the case that I can't access my gdrive (which I don't see happening really).

Post reply on HN