Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

141–150 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#141

Post by Markoff »

throwaway834343 wrote: post #5

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…

hahahaha, I know personally owner of the site and trust me it's VERY MUCH for profit site making him decent income for last 15 years living in Thailand travelling around world scubadiving and having fun

it's not just ads, but also paid API access AFAIR

nothing wrong with that, just not sure where you come with idea he would bother, if there would not be good money in it

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#142

Post by piechlediech »

emptysongglass wrote: post #132

And this is why users protect themselves with services like Firefox Relay, something Dustin Ingram, a Python Software Foundation Director, doesn't appear to understand [1] or care. My email was leaked in this breach, along with many others, an email I used to really value but one I've since relegated to the dumpster fire of "spam slot" because I learned my lesson too late. Dustin has now locked that GitHub to only pr…

The blame belongs solely on opensubtitles.org for using a list to block users and getting hacked. They probably have their reasons but still I feel it is hostile to users that care about privacy.

Firefox Relay is a disposable mail service, so it makes sense to include it in a list of such services. I wonder how they handle mail aliases like GMail allow with + or . as separators.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#143

Post by darau1 »

emptysongglass wrote: post #132

And this is why users protect themselves with services like Firefox Relay, something Dustin Ingram, a Python Software Foundation Director, doesn't appear to understand [1] or care. My email was leaked in this breach, along with many others, an email I used to really value but one I've since relegated to the dumpster fire of "spam slot" because I learned my lesson too late. Dustin has now locked that GitHub to only pr…

Interesting. The service I use isn't there lol I'm afraid to tell anyone, now, lest it be put on the list.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#144

Post by stevenwoo »

mkdirp wrote: post #51
johnchristopher wrote: post #23

Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surfac…

> Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). This was actually optional, and always was. I think the issue was that they had made some changes in the backend, but the addons didn't update the code to accommodate. At least this was the case for Kodi. The opensubtitles addon ha…

The website began to require login within the last three days for me.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#145

Post by franciscop »

woutifier wrote: post #30
franciscop wrote: post #8

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed pass…

Defense against rainbow tables is obtained via salt, not via slow hashes. A rainbow table is a space-time tradeoff (you give space, and you get time), so using a slow hash only "encourages" (for lack of me knowing a better word) creating rainbow tables. Adding long salts on the other hand requires the attacker to create an infeasible number of rainbow tables (one for each possible value of the salt).

True, I might be mixing names. What I mean is that now with fast hashes it's feasible to take for each user and compute a table with the 1,000,000 most common passwords and their specific salt, and repeat for all the users. With a modern homemade GPU rigs making billions[1] of computations per second, you are testing thousands of users per second with a 1M word dictionary, so you are going to find matches.

[1] https://hackaday.com/2012/12/06/25-gpus-brute-force-348-bill...

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#146

Post by johnchristopher »

Markoff wrote: post #136
johnchristopher wrote: post #23

Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surfac…

huh? I use to download subtitles in VLC through built in VLsub via opensubtitles and nobody ask me for any login/pwd and I download A LOT of subs, sometimes even 5-10 to try with some releases now on the website I would hit the limit very fast, but through VLsub it's essentially unlimited

There was a time the built-in VLSub wasn't built-in and I remember at some point it was abandoned and then picked up again. Nowadays it's working again as intended, no more freezes or invalid login. Still has the bug where the next video in a queue picks up the good subtitles but it downloads the subtitle for the previous video.

I googled vlsub opensubtitles not working and I still find relevant threads https://forum.videolan.org/viewtopic.php?t=152485

I have been using opensubtitles since they opened the site though and I couldn't really tell when the problem appeared and disappeared.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#147

Post by m-p-3 »

Alright, changed my password, and to mitigate the issue I tried switching the email to a disposable one (@mozmail.com) and never received the email confirmation to apply the change.

Looks like I'll just delete my account and never come back then.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#149

Post by mnw21cam »

Markoff wrote: post #139
sneeds wrote: post #84

> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Sorry, but this is no excuse. It has been 15 years and there were so many breaches that even many casual people know about databases leaks and that passwords have to be stored in some special way. I don't know this guy's background, but he at least knows that md5 is not sufficient here. And then it…

to his defense it's not like there is anything serious stored there with those accounts, it's just subtitles

It's not just subtitles - it's all the login information stored there as well. Email addresses to send spam to, passwords that have likely been reused on another site.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#150

Post by johnchristopher »

Liquix wrote: post #112
morrbo wrote: post #79

Earlier quoted context omitted.

Can you name a few please?

https://github.com/a4k-openproject/a4kSubtitles anonymous, scrapes a handful of sites including opensubtitles + subscene

I am confused, the GIF show a login+password for opensubtitles https://camo.githubusercontent.com/a1cd19d17f0484669e61673fa....

Oh, well. I'll give a try next time I launch kodi, thanks for the tip.

Post reply on HN