Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

131–140 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#131

Post by stef25 »

korginator wrote: post #65

By now I assume that any service where I've registered for an account is being actively targeted and that any organisation that's not a Google, Microsoft or the likes has already been breached. MFA is your friend, and even plain vanilla SMS based MFA is better than just a username and password for authentication. I've enabled hardware based MFA anywhere it's supported. 15-20 years ago it was fun to sign up for dozens…

About 10 years ago I found this feature of Gmail where you could see the login history, with lots of entries with IPs from China, the US and various other countries. That really drove the point home for me. Since then it's all unique passwords stored in Keepass. And it still doesn't feel 100% secure.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#132

Post by emptysongglass »

And this is why users protect themselves with services like Firefox Relay, something Dustin Ingram, a Python Software Foundation Director, doesn't appear to understand [1] or care. My email was leaked in this breach, along with many others, an email I used to really value but one I've since relegated to the dumpster fire of "spam slot" because I learned my lesson too late.

Dustin has now locked that GitHub to only previous contributors so users are once again left voiceless and powerless in the continuing war against their privacy.

We've been thinking of the business owners and the children [2] for decades now. It's time to start thinking of the users, people like you and me who are exploited constantly for everything they have to be unceremoniously discarded in a waste heap once they've been used up.

[1] https://github.com/disposable-email-domains/disposable-email...

[2] https://news.ycombinator.com/item?id=29978952

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#133

Post by danhoule »

Aissen wrote: post #58

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

I believe that this is a great idea but I was kind of wondering why people are not resorting to this method?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#134

Post by FabHK »

sysadm1n wrote: post #123

Is there a database of subtitles besides Opensubtitles that we can use as a fallback? It would be great if there was a Github repo with a updated lists of .SRT files we can download at our leisure. Only caveats: - Github wouldn't like millions flocking to a repo to grab files. - I'm not sure sharing of subtitles fall under 'copyright violations'. It's a bit of a grey area. (it's just text right?!)

There's a python "app" called subliminal (with a simple CLI) that handles the whole enchilada for you - identify the movie, contact several subtitle dbs to download the appropriate subtitles.

Not sure how up-to-date it is kept, but for me it works reasonably well, except for obscure films.

https://github.com/Diaoul/subliminal

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#135

Post by Liquid_Fire »

nano9 wrote: post #101
throwaway834343 wrote: post #5

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…

I don't understand such a website anyway. A website like OpenSubtitles seems like overkill for passing around text and timestamps. Why not use something like GitHub? Why couldn't the project simply be a big git repo? It would even be easier.

This is a little bit like saying Dropbox could just be a git repo. Yes, it could, but normal users don't know how to use git, and it adds features that git by itself doesn't provide.

Not to mention having this on GitHub would probably get taken down almost instantly due to copyright infringement.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#136

Post by Markoff »

johnchristopher wrote: post #23

Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surfac…

huh? I use to download subtitles in VLC through built in VLsub via opensubtitles and nobody ask me for any login/pwd and I download A LOT of subs, sometimes even 5-10 to try with some releases

now on the website I would hit the limit very fast, but through VLsub it's essentially unlimited

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#137

Post by lbriner »

aniforprez wrote: post #82
gattilorenz wrote: post #41

Earlier quoted context omitted.

> nothing was leaked in august, we followed the hackers request, secured our services, hired an extra sysadmin, ran extra audits. Oh yes, what could ever go wrong with keeping already compromised passwords? Plus it was clearly a white hacker that helped them secure the website, the required fee was for this service. /s

It's truly appalling that so many times, on HN even, people genuinely recommend paying the ransom because "hackers won't go back on their word cause it'll ruin their reputation". If you're hacked, purge the passwords and reset everyone and do everything in your power to ensure no one can access it in a similar way again. I have no idea why anyone would think a hacker wouldn't simply turn around and sell the data anyw…

I don't personally agree with paying the ransom but the logic seems sound.

If you pay them, they might keep their word. After all, how much would they get paid for a list of passwords compared to a ransom payment?

If you don't pay them, they are more likely to either sell or leak the lists.

In this case, although easy to say now, the correct answer is not to create public web applications until you know how to store passwords correctly and host databases securely, it's not like the information isn't readily available.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#138

Post by Markoff »

Aeolun wrote: post #39
martin_a wrote: post #33

> It is kind of amazing, that the site was hacked now, after 15 years - so that hacker must have spent quite a lot of time and energy on it. I'm pretty sure that it did not take "that hacker" 15 years to find this vulnerability. Pretty strange forum post.

Website still managed by a just graduated 21 year old?

he is not that young, roughly my age around 40 living in Ko Phangan

here are his videos since his website is dead and he is also not active on twitter anymore https://www.youtube.com/user/BranoGege/videos

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#139

Post by Markoff »

sneeds wrote: post #84

> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Sorry, but this is no excuse. It has been 15 years and there were so many breaches that even many casual people know about databases leaks and that passwords have to be stored in some special way. I don't know this guy's background, but he at least knows that md5 is not sufficient here. And then it…

to his defense it's not like there is anything serious stored there with those accounts, it's just subtitles

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#140

Post by Markoff »

sysadm1n wrote: post #123

Is there a database of subtitles besides Opensubtitles that we can use as a fallback? It would be great if there was a Github repo with a updated lists of .SRT files we can download at our leisure. Only caveats: - Github wouldn't like millions flocking to a repo to grab files. - I'm not sure sharing of subtitles fall under 'copyright violations'. It's a bit of a grey area. (it's just text right?!)

I use opensusbtitles only through VLsub in VLC, if I have to go somewhere on my own (no susbs found on OS in VLC) I go to subscene
Post reply on HN