Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

Post by l-lousy » Wed, Jan 19, 2022, 12:13 PM UTC

stevewodil wrote: post #63

Aissen wrote: post #58

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

Slightly related, in order to prevent super long passwords from eating up CPU time is it better to hash using sha256 before argon/bcrypt so that the length is constant, or is it better to limit password length to some arbitrary number like 64 characters

Post by tialaramex » Wed, Jan 19, 2022, 12:26 PM UTC

gwd wrote: post #49

tialaramex wrote: post #43

Earlier quoted context omitted.

Nobody is saying bcrypt isn't a good choice here, they're saying that rainbow tables (and all time-space trades) are made infeasible by salt regardless of whether you're using a good password hash like bcrypt.

But both you & GGP are talking about bcrypt as though it was only a password hash. If someone says, "I'm using bcrypt", then they are using both a password hash and unique per-password salts, or they're not using bcrypt. What makes bcrypt and other such systems nice (and makes this kind of mistake basically inexcusable in 2022) is that if you're using a library or package which implements it (which you should), you d…

Post by kevincox » Wed, Jan 19, 2022, 12:43 PM UTC

korginator wrote: post #65

By now I assume that any service where I've registered for an account is being actively targeted and that any organisation that's not a Google, Microsoft or the likes has already been breached. MFA is your friend, and even plain vanilla SMS based MFA is better than just a username and password for authentication. I've enabled hardware based MFA anywhere it's supported. 15-20 years ago it was fun to sign up for dozens…

Post by toyg » Wed, Jan 19, 2022, 12:49 PM UTC

lillecarl wrote: post #13

PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use). BitWarden is open source, both server and clients. There's even a thir…

Post by morrbo » Wed, Jan 19, 2022, 12:52 PM UTC

mkdirp wrote: post #51

johnchristopher wrote: post #23

Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surfac…

> Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). This was actually optional, and always was. I think the issue was that they had made some changes in the backend, but the addons didn't update the code to accommodate. At least this was the case for Kodi. The opensubtitles addon ha…