Link to the password dump: http://pastebin.com/ieC6eTB7
Any link to the password dump from the Brazzers attack referenced in the article?
YouPorn passwords available for download, thousands of users exposed
21–30 of 90 posts
Re: YouPorn passwords available for download, thousands of users exposed
#22Kudos on the double entendre in the title, intentional or not.
im so glad you noticed this, because it got me laughing but i couldnt decide if it was on purpose or not either! A good joke on words makes the world a better place.
I was thrilled on the self-describing appropriateness of the term "double entendre" in this context until I found that "entendre" didn't actually mean "enter" in French. If it would, the term itself would be hilarious.
Re: YouPorn passwords available for download, thousands of users exposed
#23http://blog.youporn.com/youporn-data-not-exposed/
It was actually the passwords to YP Chat, not Youporn itself. The Yourporn guys are pretty reasonable engineers and sysadmins, from what I've seen, and manage user passwords correctly.
Personally, I think in 2012, if you're not using a password manager to generate and manage unique, strong passwords per site, especially for "sketchy" stuff like porn sites, you're already doomed.
Also, Presidents Day and other minor useless holidays are great times for annual rituals like tracking down and changing any legacy shared passwords you may have. Don't wait for a breach!
Re: YouPorn passwords available for download, thousands of users exposed
#24Bonus: it appears YouPorn has no way to change your password, nor any way to change (or even see) the email address that is associated with your account.
Re: YouPorn passwords available for download, thousands of users exposed
#25How many sites need to be humiliated like this before people learn to hash passwords with something like bcrypt? It's like two damn functions. You just call them! It's so easy that even a baby squirrel could do it! There is no excuse. Until then, I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones.
Besides "use bcrypt" I've never really seen decent guidance on how to actually store passwords (what sort of salt to use, where to store the salt, if and where to store the hash method, how/where to store the key, etc).
"Use bcrypt" is the answer to all those things. Bcrypt includes a salt, which is stored along with the method in the hash string. Hashing is not the same as encryption, so there is no key involved.
Re: YouPorn passwords available for download, thousands of users exposed
#26http://blog.youporn.com/youporn-data-not-exposed/ It was actually the passwords to YP Chat, not Youporn itself. The Yourporn guys are pretty reasonable engineers and sysadmins, from what I've seen, and manage user passwords correctly. Personally, I think in 2012, if you're not using a password manager to generate and manage unique, strong passwords per site, especially for "sketchy" stuff like porn sites, you're alre…
The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password.
Yet, friends and HN hackers alike have scoffed at my attitude which is roughly the same as yours. If you're blindly trusting sites with a non-unique password, it's only a matter of time.
(edit) To get ahead of the repeat replies, LastPass syncs across browser extensions, encrypt/decrypts locally, can be accessed from any browser even without an extension and has mobile apps. I've been using it for probably two years now and I've never not been able to access an account even when using all varieties of guest computers, iPads, etc.
Re: YouPorn passwords available for download, thousands of users exposed
#27How many sites need to be humiliated like this before people learn to hash passwords with something like bcrypt? It's like two damn functions. You just call them! It's so easy that even a baby squirrel could do it! There is no excuse. Until then, I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones.
> I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones.
Why even bother with the distinction. Use a unique password for every login. Use something to manage your passwords. If someone is unwilling to generate a password for an unimportant site, they're probably also too lazy to properly generate unique passwords for sites that matter.
Re: YouPorn passwords available for download, thousands of users exposed
#28I'm CTO for Manwin Canada and ultimately responsible for YouPorn.
It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably that some have re-used the same username password combination that is highly unrecommended for all you folks out there (if you read Hacker News, you already know that).
As for password policies, I've been enforcing hashing of passwords ever since joining, though as we inherit a lot of old code and sites we correct issues such as that as we come across them.
I'll be around for a while, if anyone wants to ask questions.
Re: YouPorn passwords available for download, thousands of users exposed
#29Always good to have a throwaway email, username and password for sites like this and others you care little about.
I've always used mailinator for this. Makes a great site for that kind of thing.
Re: YouPorn passwords available for download, thousands of users exposed
#30Why would anyone sign up for a porn site with their main email address? What baffles me even more is how some people actually whip out their credit card and give the digits to a porn site.
What baffles me even more is how some people actually whip out their credit card and give the digits to a porn site.
Why? Most of the big porn studios are as trustworthy as any other Internet business of the same size, and if your credit card number is misused, you're not liable for the charges anyway. Porn popularized selling DRM-free content for money long before Louis CK made it popular. Porn actors need to pay their rent too.