Bahaha I made an account a few days ago! So glad I used a throwaway email.
Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
151–160 of 194 posts
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#152> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt
Read as: In the last fifteen years we couldn't be bothered to fix our glaring security hole.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#153A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.
> simply do bcrypt(md5(password)) This could also be problematic. Password Shucking https://www.youtube.com/watch?v=OQD3qDYMyYQ
I wonder if adding a random salt for each account would help in that situation?.
bcrypt(md5(password) + salt) + salt
the problem with password shucking would be that they just do a bcrypt(md5) over the list of md5 hashes they have and check if they exist in your database.
but if each hash is salted they would need to run every their complete md5 hash list through bcrypt for each account instead of once per database.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#154By now I assume that any service where I've registered for an account is being actively targeted and that any organisation that's not a Google, Microsoft or the likes has already been breached. MFA is your friend, and even plain vanilla SMS based MFA is better than just a username and password for authentication. I've enabled hardware based MFA anywhere it's supported. 15-20 years ago it was fun to sign up for dozens…
It is very annoying how more and more shops force you to give a phone number... IMHO (unless product defect) only the transporter should get that !
Twitch (Authy), eBay and Amazon come to mind as the most annoying examples. My god just give me TOTP or stop pestering me for my number. eBay is so idiotic that it even asks for security questions. The 2000s called, they want their obsolete security back.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#155By now I assume that any service where I've registered for an account is being actively targeted and that any organisation that's not a Google, Microsoft or the likes has already been breached. MFA is your friend, and even plain vanilla SMS based MFA is better than just a username and password for authentication. I've enabled hardware based MFA anywhere it's supported. 15-20 years ago it was fun to sign up for dozens…
About 10 years ago I found this feature of Gmail where you could see the login history, with lots of entries with IPs from China, the US and various other countries. That really drove the point home for me. Since then it's all unique passwords stored in Keepass. And it still doesn't feel 100% secure.
My old outlook account receives log in attempt every ~5mins (!!) from all over the world. It's actually crazy that the attempts have not stopped after failing for so long, probably indicates it's from different attackers. The email has been on a couple of leaks but even then, the sheer amount of attempts is so crazy that I'd assume they are using a lot of password leaks that aren't publicly known yet.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#156Earlier quoted context omitted.
https://github.com/a4k-openproject/a4kSubtitles anonymous, scrapes a handful of sites including opensubtitles + subscene
I am confused, the GIF show a login+password for opensubtitles https://camo.githubusercontent.com/a1cd19d17f0484669e61673fa... . Oh, well. I'll give a try next time I launch kodi, thanks for the tip.
It says "Optional" next to the username/password.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#157Earlier quoted context omitted.
I think one use case was subtitle downloading (typically, a client like Subdownloader) for VPN users, whose requests would be denied if unauthenticated.
Why? The site's raison d'etre is to make subtitles readily available for downloading by anyone. What is the purpose of locking it behind authentication? What did that realistically achieve?
Spam was one reason (I've actually asked to the admins, which were very pissed off by it).
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#158I've lost a lot of trust in opensubtitles since they started going down for "scheduled maintenance" for about two hours a day during the west coast evening, started selling advertising in the middle of the subtitles, and launched a "2.0" in the form of opensubtitles.com that continues to have a confusing and poorly described relationship with opensubtitles.org.
The whole thing has just given a solid impression of being poorly managed, and the way this breach notification is written really reinforces that. It's unfortunate as I would be happy to donate money but... not to opensubtitles, which seems to be too deep in a hole to realistically get back out of it.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#159You did right: no need to pay the ransom.
I'm confused. Didn't he say that he DID pay the ransom?
My bad, you are right.
He said they paid.
The short history of ransomware shows whenever the ransom was paid, the attackers came back again to threat and solicit more money. It's advised not to pay. But only the business owners could have the right "feeling" as they are the only ones who communicated with the attacker(s)
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#160> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Ouch! I hope they learned their lesson: Security is an ongoing effort.
16 years without reviewing password security seems like a massive oversight. A major leak like this it's a high price to pay to learn this lesson.
The really bad thing is that md5 was considered broken in 2005 by security people like Bruce Schneier.
To be fair to them it took till around 2008 for this to become widespread opinion but the signs were on the wall around 2004