Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YouPorn passwords available for download, thousands of users exposed

nakedsecurity.sophos.com

Post reply on HN
Print view View original

41–50 of 90 posts

Re: YouPorn passwords available for download, thousands of users exposed

#41

Post by dredmorbius »

phamilton wrote: post #32
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my atti…

I don't use a password manager because I don't always use the same computer. As a student I use a number of different machines on campus. A password manager would be extremely inconvenient. I do, however, use a simple templated password. By including a few unique characters (following an easy to remember formula from the sites domain name) in an already strong base password, I can use dozens of unique passwords witho…

There are several options which use remotely-saved, decrypted-in-browser password safes. You're still vulnerable to keyboard logging if you're using random systems/hardware. Accessing secure services you care about from multiple locations is not a good security practice.

If you carry a smartphone, there are several password safes available for these as well.

Clipperz (web-based) and KeePassDroid work for me.

On my primary systems, a simple text-based database GPG encrypted.

Your password template may or may not be good practice. From random cracking, probably safe. If someone takes a particular interest in you and has prior knowledge of your scheme and several revealed examples, other passwords may become discoverable.

Re: YouPorn passwords available for download, thousands of users exposed

#42

Post by HNatWORK »

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

It should be trivial to determine which accounts have the same passwords, are you taking any proactive steps to help secure these accounts?

Re: YouPorn passwords available for download, thousands of users exposed

#43

Post by pstatho »

rhizome wrote: post #39
pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Something about that URL tells me you didn't always mind if people associated the two together.

I suppose at some point the old owners did want to make that association. That deal was in place since 2008, we've been managing it for less than a year now.

We've been focusing on the rewrite of the main site and are now cleaning up all the secondary dependencies.

Re: YouPorn passwords available for download, thousands of users exposed

#44

Post by ppod »

pjscott wrote: post #2

How many sites need to be humiliated like this before people learn to hash passwords with something like bcrypt? It's like two damn functions. You just call them! It's so easy that even a baby squirrel could do it! There is no excuse. Until then, I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones.

>hash passwords with something like bcrypt? It's like two damn functions. You just call them!

I estimate that the average web user understands about 66% of those words. And that's if we give them 'password'.

Re: YouPorn passwords available for download, thousands of users exposed

#45

Post by pstatho »

HNatWORK wrote: post #42
pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

It should be trivial to determine which accounts have the same passwords, are you taking any proactive steps to help secure these accounts?

Yes we are identifying which ones are affected. Due to changes over the years of how account information was handled, we want to be extra sure we are identifying the proper accounts, if any.

Re: YouPorn passwords available for download, thousands of users exposed

#46

Post by rdl »

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Thanks for showing up here!

By hashing, do you mean current best practice (bcrypt, scrypt, or possibly a pbkdf with high work factor), or something easily brute forced like MD5 and SHA1. There are issues with migration if you're doing the latter, but not a big deal.

Do you have any contractual recourse against the chat provider? Have you considered including such terms in future contracts with partners?

Do you have a security audit firm? There's plenty of value to in-house audits, but some kind of independent audit is probably a reasonable choice. You probably don't have PCI concerns (it's free, right?), but users might feel better about privacy otherwise. Just the existence of an account for a given user is probably an issue for some people, so even foolish things like using the same username on a porn site as on other sites could be a leak -- being able to verify that myhusbandinvirginiasportsfan is a valid user account on youtube would potentially make a divorce attorney very happy.

Would you answer general questions about the site/business, too? The whole porn tube thing seems like a big change in the industry (I was at SHOT Show in Vegas a few weeks ago, and stopped by the concurrent AVN event -- they really hate the tubes). I'm especially curious how you feel about the meta-tube sites (e.g. fantasti.cc) which seem to blatantly scrape youporn (and other tube) content. Preroll ads still show, but nothing else.

Re: YouPorn passwords available for download, thousands of users exposed

#47

Post by rdl »

outworlder wrote: post #34
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my atti…

The thing with password managers is that the most convenient ones store your data in a server somewhere. And that opens up more issues than it solves. For the ones that store information in a local file, that could work. But then a lot of the mobility is lost, even if you use something like Dropbox (you are not going to sync behind a corporate firewall, for instance). At least my brain is attached to my head and is v…

I really like 1Password (but I use only macs for low security laptop/desktop stuff) -- the browser extension is great, and the iOS apps sync over wifi or dropbox.

The one thing I'm waiting for is iCloud integration. If they don't provide iCloud integration, I'd consider other options (including trying to roll-your-own, maybe using their extensions and spoofing the IPC)

Re: YouPorn passwords available for download, thousands of users exposed

#48

Post by ars »

Cushman wrote: post #25
pbreit wrote: post #16

Earlier quoted context omitted.

Besides "use bcrypt" I've never really seen decent guidance on how to actually store passwords (what sort of salt to use, where to store the salt, if and where to store the hash method, how/where to store the key, etc).

"Use bcrypt" is the answer to all those things. Bcrypt includes a salt, which is stored along with the method in the hash string. Hashing is not the same as encryption, so there is no key involved.

If you are using PHP then do this:

    $salt = '$2a$08$' . $random_data;
    $hash = crypt($password, $salt);
$random_data is 22 random letters from A-Za-z0-9.= (16.5 bytes)

(08 is the cost factor - you can change it, but 8 seemed reasonable in my tests.)

If you google bcrypt and php you'll find a very complex and large class for doing this. It's no longer necessary - current versions of PHP have it built in.

Re: YouPorn passwords available for download, thousands of users exposed

#49

Post by rdl »

noobface wrote: post #3
pjscott wrote: post #2

How many sites need to be humiliated like this before people learn to hash passwords with something like bcrypt? It's like two damn functions. You just call them! It's so easy that even a baby squirrel could do it! There is no excuse. Until then, I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones.

It'll just take one congressman's e-mail password to be the same as his YouPorn password, then it'll be law to encrypt.

Really, all it takes is a congressman's email address being on his porn site account, even sans password, if it gets leaked somehow.

Re: YouPorn passwords available for download, thousands of users exposed

#50

Post by pjscott »

pbreit wrote: post #16
pjscott wrote: post #2

How many sites need to be humiliated like this before people learn to hash passwords with something like bcrypt? It's like two damn functions. You just call them! It's so easy that even a baby squirrel could do it! There is no excuse. Until then, I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones.

Besides "use bcrypt" I've never really seen decent guidance on how to actually store passwords (what sort of salt to use, where to store the salt, if and where to store the hash method, how/where to store the key, etc).

I'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same. When a user gives you their password for the first time, here's what you store in your database:

    hashed_password = bcrypt.hashpw(password, bcrypt.gensalt())
Store hashed_password in your database for later. Then, when a user tries to log in, they will tell you their password. You'll need to check that it matches the hashed_password value you have stored. Here's how:

    if bcrypt.hashpw(password, hashed_password) == hashed_password:
        print 'Password is correct!'
    else:
        print 'Wrong password.'
That's all there is to it. The bcrypt library handles everything else. It is this simple because if it weren't, people would mess it up.
Post reply on HN