Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

111–120 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#111

Post by BlueTemplar »

korginator wrote: post #65

By now I assume that any service where I've registered for an account is being actively targeted and that any organisation that's not a Google, Microsoft or the likes has already been breached. MFA is your friend, and even plain vanilla SMS based MFA is better than just a username and password for authentication. I've enabled hardware based MFA anywhere it's supported. 15-20 years ago it was fun to sign up for dozens…

It is very annoying how more and more shops force you to give a phone number... IMHO (unless product defect) only the transporter should get that !

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#112

Post by Liquix »

morrbo wrote: post #79
mkdirp wrote: post #51

Earlier quoted context omitted.

> Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). This was actually optional, and always was. I think the issue was that they had made some changes in the backend, but the addons didn't update the code to accommodate. At least this was the case for Kodi. The opensubtitles addon ha…

Can you name a few please?

https://github.com/a4k-openproject/a4kSubtitles

anonymous, scrapes a handful of sites including opensubtitles + subscene

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#113

Post by tiborsaas »

weird-eye-issue wrote: post #106
tiborsaas wrote: post #100

Earlier quoted context omitted.

$1 / 1000 visitor is $110k / month with 11 million visitors which agrees with my estimation.

You want to double check your math there?

Hahh, "I don't need a calculator" :) Regardless, I can't find the source, but I remember reading that this site is a cash cow.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#114

Post by mooreds »

ThreeToZero wrote: post #89
DrBoring wrote: post #86

Earlier quoted context omitted.

> to prevent super long passwords from eating up CPU time Is that why websites sometimes have low maximum password length requirements ? Ex: must be less than 20 characters.

Super long is >100 character passwords. Not much point: either the hash function is broken or some other hack will happen before humanity develops enough compute power to crack 100 char bcrypt passwords. Websites (like some banks used to) that have less-than 20 char limits for passwords are purely bad security strategy.

You know what the worst is? When they limit you to, say, 20 or 32 characters, but accept a longer password and silently truncate it!

I've run across that at least once and it was a total pain to troubleshoot and figure out.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#115

Post by jjice »

Tangentially related to this: Is storing passwords actually hard, or is it knowing know to do things like this that is?

I've seen a lot of people on HN talk about how they never store passwords because they don't want the liability, and I've seen some talk about how they do since it's simple. In my experience, hashing with Argon2 and keeping that in the DB (for toy personal projects) has been very easy, especially to how scary keeping passwords seems to have been made.

I guess my real question is: If I'm hashing with an actual password acceptable hash method (salt and all), is there any reason I shouldn't still do this? I'm legitimately interested, because for all I know, I'm experiencing the Dunning-Kruger effect.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#116

Post by [deleted] »

stef25 wrote: post #108
woutifier wrote: post #30

Earlier quoted context omitted.

Defense against rainbow tables is obtained via salt, not via slow hashes. A rainbow table is a space-time tradeoff (you give space, and you get time), so using a slow hash only "encourages" (for lack of me knowing a better word) creating rainbow tables. Adding long salts on the other hand requires the attacker to create an infeasible number of rainbow tables (one for each possible value of the salt).

Where do you store the salt?

[deleted]

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#117

Post by marcosdumay »

dabeledo wrote: post #64
Aissen wrote: post #58

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

> simply do bcrypt(md5(password)) This could also be problematic. Password Shucking https://www.youtube.com/watch?v=OQD3qDYMyYQ

Ok, some text with a 3 lines explanation of the attack, instead of a 45 minutes video where it's explained somewhere in less than a second:

https://security.stackexchange.com/questions/234794/is-bcryp...

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#118

Post by BlueTemplar »

ilogik wrote: post #4
m3adow wrote: post #2

> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Ouch! I hope they learned their lesson: Security is an ongoing effort.

for 2006 that's actually not bad. When I joined my first company in 2010, to my horror, they were using plain text passwords for users

Yeah, just last month I was shocked to see a shop where I forgot my 2017 password, to send it to me. in plain text. by e-mail. (at least IIRC they used HTTPS on their website !)

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#119

Post by TedDoesntTalk »

BlueTemplar wrote: post #109
PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

Well, for this kind of negligible importance website risk management is simple : just use a variation on "password for opensubtitles" as a password (and maybe even have it saved by your browser). (If like me, you find the idea of a password manager not acceptable.)

Agreed. If they don’t have anything personal but my email address, I use a password that’s been compromised and reused for 10 years but easy to remember. Weigh the risk and exposure against.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#120

Post by foxtrottbravo »

Reading this makes me furious, not because they were hacked but because this shitshow of a Website was so damn lazy.

(paraphrasing) "We were stupid 15 years ago and have been lazy ever since" is a slap to the face.

Maybe they should have done something about their platform instead of watching anime with subtitles.

Those people should have their internet privileges permanently removed and the whole site should be burned in a dumpster like the dumpsterfire of security they had running for fucking 15 years.

Post reply on HN