Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

101–110 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#101

Post by nano9 »

throwaway834343 wrote: post #5

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…

I don't understand such a website anyway. A website like OpenSubtitles seems like overkill for passing around text and timestamps. Why not use something like GitHub? Why couldn't the project simply be a big git repo? It would even be easier.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#103

Post by BlueTemplar »

GordonS wrote: post #91
ThreeToZero wrote: post #89

Earlier quoted context omitted.

Super long is >100 character passwords. Not much point: either the hash function is broken or some other hack will happen before humanity develops enough compute power to crack 100 char bcrypt passwords. Websites (like some banks used to) that have less-than 20 char limits for passwords are purely bad security strategy.

The number of sites that restrict passwords to 20 characters drives me nuts! There needs to be a limit, yes, but surely something like 100 characters, or even 50, would be more sensible.

And it's the same websites that tend to use the bad practice of forcing the use of 2-4 "types" of characters...

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#104

Post by colejohnson66 »

DrBoring wrote: post #86
stevewodil wrote: post #63

Earlier quoted context omitted.

Slightly related, in order to prevent super long passwords from eating up CPU time is it better to hash using sha256 before argon/bcrypt so that the length is constant, or is it better to limit password length to some arbitrary number like 64 characters

> to prevent super long passwords from eating up CPU time Is that why websites sometimes have low maximum password length requirements ? Ex: must be less than 20 characters.

The CPU usage difference between a hash on 20 bytes vs 100 (assuming ASCII) can't be that bad, can it?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#105

Post by userbinator »

ThreeToZero wrote: post #89
DrBoring wrote: post #86

Earlier quoted context omitted.

> to prevent super long passwords from eating up CPU time Is that why websites sometimes have low maximum password length requirements ? Ex: must be less than 20 characters.

Super long is >100 character passwords. Not much point: either the hash function is broken or some other hack will happen before humanity develops enough compute power to crack 100 char bcrypt passwords. Websites (like some banks used to) that have less-than 20 char limits for passwords are purely bad security strategy.

like some banks used to

Banks all have systems that will stop you from attempting to bruteforce them.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#106

Post by weird-eye-issue »

tiborsaas wrote: post #100
weird-eye-issue wrote: post #74

Earlier quoted context omitted.

You are overestimating how much ad revenue comes in from non Tier 1 countries and from that specific niche. I'd be surprised if they get more than $1-2 per 1000 visitors. Could be lower than that

$1 / 1000 visitor is $110k / month with 11 million visitors which agrees with my estimation.

You want to double check your math there?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#107

Post by apetresc »

k4rli wrote: post #68
johndoeee wrote: post #24

Earlier quoted context omitted.

> The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting Opensubtitles has a VIP program at $15 a year. It's quite easy to find the person who runs the site and, according to their CV, this is basically their job. That'd make Opensubtitles a for-profit piracy site, i guess.

Subtitles aren't piracy in any way though. Kind of similar to legality of torrent sites but even less questionable.

I don't think they're implying the subtitles themselves are piracy, but the users of opensubtitles.org are overwhelmingly using them for pirated media. The subs are all indexed against scene versions of the video files (as you can tell from their names), and that's what most users are using it for. After all, streaming services, DVDs, and other legitimate ways of consuming these shows/movies already come with subtitles.

No, the 0.1% of subs for obscure indie shows that didn't have native subs doesn't change that.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#108

Post by stef25 »

woutifier wrote: post #30
franciscop wrote: post #8

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed pass…

Defense against rainbow tables is obtained via salt, not via slow hashes. A rainbow table is a space-time tradeoff (you give space, and you get time), so using a slow hash only "encourages" (for lack of me knowing a better word) creating rainbow tables. Adding long salts on the other hand requires the attacker to create an infeasible number of rainbow tables (one for each possible value of the salt).

Where do you store the salt?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#109

Post by BlueTemplar »

PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

Well, for this kind of negligible importance website risk management is simple : just use a variation on "password for opensubtitles" as a password (and maybe even have it saved by your browser).

(If like me, you find the idea of a password manager not acceptable.)

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#110

Post by jjice »

stef25 wrote: post #108
woutifier wrote: post #30

Earlier quoted context omitted.

Defense against rainbow tables is obtained via salt, not via slow hashes. A rainbow table is a space-time tradeoff (you give space, and you get time), so using a slow hash only "encourages" (for lack of me knowing a better word) creating rainbow tables. Adding long salts on the other hand requires the attacker to create an infeasible number of rainbow tables (one for each possible value of the salt).

Where do you store the salt?

The salt can be stored directly in front of the hash in the same string in the DB (a lot of crypto hash functions will output this). It can be plaintext since the goal is to add a random component so rainbow tables wouldn't be possible since there's always more to the string being hashed. That's where it becomes a time problem.

Yeah, you could rebuild a rainbow table yourself u til you find the collision, but you have to search every bit of the potential hash space.

Post reply on HN