Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YouPorn passwords available for download, thousands of users exposed

nakedsecurity.sophos.com

Post reply on HN
Print view View original

31–40 of 90 posts

Re: YouPorn passwords available for download, thousands of users exposed

#31

Post by danso »

rdl wrote: post #23

http://blog.youporn.com/youporn-data-not-exposed/ It was actually the passwords to YP Chat, not Youporn itself. The Yourporn guys are pretty reasonable engineers and sysadmins, from what I've seen, and manage user passwords correctly. Personally, I think in 2012, if you're not using a password manager to generate and manage unique, strong passwords per site, especially for "sketchy" stuff like porn sites, you're alre…

I'm going to guess that there's a significant subset of YPChat users who also created YP accounts and also used the same login credentials for both...I mean, how many users who are savvy enough to create multiple-logins/passwords for a site and its chat subdomain would even create an account (one linkable to their identity) on YP in the first place?

Re: YouPorn passwords available for download, thousands of users exposed

#32

Post by phamilton »

drivebyacct2 wrote: post #26
rdl wrote: post #23

http://blog.youporn.com/youporn-data-not-exposed/ It was actually the passwords to YP Chat, not Youporn itself. The Yourporn guys are pretty reasonable engineers and sysadmins, from what I've seen, and manage user passwords correctly. Personally, I think in 2012, if you're not using a password manager to generate and manage unique, strong passwords per site, especially for "sketchy" stuff like porn sites, you're alre…

The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my atti…

I don't use a password manager because I don't always use the same computer. As a student I use a number of different machines on campus. A password manager would be extremely inconvenient.

I do, however, use a simple templated password. By including a few unique characters (following an easy to remember formula from the sites domain name) in an already strong base password, I can use dozens of unique passwords without any special environment.

Re: YouPorn passwords available for download, thousands of users exposed

#33

Post by drivebyacct2 »

phamilton wrote: post #32
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my atti…

I don't use a password manager because I don't always use the same computer. As a student I use a number of different machines on campus. A password manager would be extremely inconvenient. I do, however, use a simple templated password. By including a few unique characters (following an easy to remember formula from the sites domain name) in an already strong base password, I can use dozens of unique passwords witho…

LastPass syncs across computers, can be opened in a private browser (decryption in the browser) and they have mobile apps.

Re: YouPorn passwords available for download, thousands of users exposed

#34

Post by outworlder »

drivebyacct2 wrote: post #26
rdl wrote: post #23

http://blog.youporn.com/youporn-data-not-exposed/ It was actually the passwords to YP Chat, not Youporn itself. The Yourporn guys are pretty reasonable engineers and sysadmins, from what I've seen, and manage user passwords correctly. Personally, I think in 2012, if you're not using a password manager to generate and manage unique, strong passwords per site, especially for "sketchy" stuff like porn sites, you're alre…

The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my atti…

The thing with password managers is that the most convenient ones store your data in a server somewhere. And that opens up more issues than it solves.

For the ones that store information in a local file, that could work. But then a lot of the mobility is lost, even if you use something like Dropbox (you are not going to sync behind a corporate firewall, for instance). At least my brain is attached to my head and is very portable, I just have to remember the damn things.

That said, do you have recommendations?

Re: YouPorn passwords available for download, thousands of users exposed

#35

Post by NelsonMinar »

Top 10 domains: 1469 yahoo.com / 1071 hotmail.com / 882 gmail.com / 205 hotmail.co.uk / 178 web.de / 136 gmx.de / 127 aol.com / 116 hotmail.de / 115 live.com / 104 hotmail.fr

Top 10 passwords: 110 123456 / 75 123456789 / 30 12345 / 23 melinda / 19 fuck / 18 1234567890 / 17 Nightmare / 16 allzen / 15 password / 15 anal

That's of about 6400 records.

Re: YouPorn passwords available for download, thousands of users exposed

#36

Post by rdl »

drivebyacct2 wrote: post #26
rdl wrote: post #23

http://blog.youporn.com/youporn-data-not-exposed/ It was actually the passwords to YP Chat, not Youporn itself. The Yourporn guys are pretty reasonable engineers and sysadmins, from what I've seen, and manage user passwords correctly. Personally, I think in 2012, if you're not using a password manager to generate and manage unique, strong passwords per site, especially for "sketchy" stuff like porn sites, you're alre…

The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my atti…

It really needs to become the default at account creation.

I'm not sure how best to make it part of the site sign up process on the server side. The other hassle is you now really want to also link mobile platforms, so unless you're all apple, it's kind of tricky. You could possibly do a web-based password manager instead of something local (there are a few options), or if you're all-apple, 1Password (which doesn't even work perfectly on iOS).

The other way is to just move everyone to Facebook Connect or other third-party identity services, but there are a bunch of problems with that. If there were a single-signon provider which were only single signon, vs. profiles and all the other stuff, it would be more acceptable, but even then, just linkability of all your accounts is a security and privacy compromise, as well as being a single point of attack and failure.

Re: YouPorn passwords available for download, thousands of users exposed

#38

Post by drivebyacct2 »

outworlder wrote: post #34
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my atti…

The thing with password managers is that the most convenient ones store your data in a server somewhere. And that opens up more issues than it solves. For the ones that store information in a local file, that could work. But then a lot of the mobility is lost, even if you use something like Dropbox (you are not going to sync behind a corporate firewall, for instance). At least my brain is attached to my head and is v…

I answered the other person that replied. LastPass syncs across browser extensions, you can access your data from their website, it's all encrypted/decrypted locally and there are mobile apps so you can always access them securely even if you don't trust the guest computer.

Re: YouPorn passwords available for download, thousands of users exposed

#39

Post by rhizome »

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Something about that URL tells me you didn't always mind if people associated the two together.

Re: YouPorn passwords available for download, thousands of users exposed

#40

Post by jarin »

___Calv_Dee___ wrote: post #18

I don't understand how this makes it to Top News. I think at this point we are all well aware that no user-password store is impenetrable or invulnerable and porn websites would hardly be an exception. If you do not know by now that you should not be using the same password across multiple accounts, it seems like there is little hope. There is no lesson to be learned here. Is it not an implicit assumption that if you…

I think it is more of a public service announcement, because it is a very popular site and yes, a lot of people on HN probably use it.
Post reply on HN