Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YouPorn passwords available for download, thousands of users exposed

nakedsecurity.sophos.com

Post reply on HN
Print view View original

51–60 of 90 posts

Re: YouPorn passwords available for download, thousands of users exposed

#51

Post by ez77 »

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

How does that work? Who assigns the DNS values for chat.youporn.com? Moreover, youporn.com and chat.youporn.com actually point to the same IP address, namely 31.192.116.24.

There must be some level of affiliation then, right?

Re: YouPorn passwords available for download, thousands of users exposed

#52

Post by pstatho »

rdl wrote: post #46
pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Thanks for showing up here! By hashing, do you mean current best practice (bcrypt, scrypt, or possibly a pbkdf with high work factor), or something easily brute forced like MD5 and SHA1. There are issues with migration if you're doing the latter, but not a big deal. Do you have any contractual recourse against the chat provider? Have you considered including such terms in future contracts with partners? Do you have a…

Hashing algorithms are not standardize across our network of sites yet. We use various methodology depending on what allows us to move fast and secure. You would be surprised to see the amount of moving parts there are.

We are currently in very close discussions with the 3rd party. In our official statement we purposely did not name them, we don't want to throw them under the bus. Of course we are reviewing all obligations.

We do deal with multiple security firms, and we regularly do security audits (both white and black box audits). We also deal with PCI, because we have paying sites as well, like Brazzers.

We can talk about the industry in general another time, but obviously we believe all types of sites can co-exist.

Re: YouPorn passwords available for download, thousands of users exposed

#53

Post by pstatho »

ez77 wrote: post #51
pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

How does that work? Who assigns the DNS values for chat.youporn.com? Moreover, youporn.com and chat.youporn.com actually point to the same IP address, namely 31.192.116.24. There must be some level of affiliation then, right?

Yes we control the DNS, since it's a subdomain. That is the new IP address of the official website.

Re: YouPorn passwords available for download, thousands of users exposed

#54

Post by andypants »

rdl wrote: post #49
noobface wrote: post #3

Earlier quoted context omitted.

It'll just take one congressman's e-mail password to be the same as his YouPorn password, then it'll be law to encrypt.

Really, all it takes is a congressman's email address being on his porn site account, even sans password, if it gets leaked somehow.

Then it'll be law to encrypt email addresses! :D

Re: YouPorn passwords available for download, thousands of users exposed

#55

Post by rdl »

verelo wrote: post #13
laconian wrote: post #4

Kudos on the double entendre in the title, intentional or not.

im so glad you noticed this, because it got me laughing but i couldnt decide if it was on purpose or not either! A good joke on words makes the world a better place.

I'm kind of surprised it wasn't taken deeper, like "penetration at adult site youporn leaves vulnerable users gaping and exposed".

Re: YouPorn passwords available for download, thousands of users exposed

#56

Post by devicenull »

pjscott wrote: post #2

How many sites need to be humiliated like this before people learn to hash passwords with something like bcrypt? It's like two damn functions. You just call them! It's so easy that even a baby squirrel could do it! There is no excuse. Until then, I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones.

Okay, let's say you have to integrate with a third party product that can only deal with passwords in normal crypt(). What do you do then? (Rewrite third party product is not a valid answer).

What if you're integrating with something like a Windows VPN w/RADIUS, which needs the plaintext password?

Bcrypt, while trivial for many applications, is not the answer to everything.

Re: YouPorn passwords available for download, thousands of users exposed

#57

Post by aaronpk »

rsanchez1 wrote: post #37
aaronpk wrote: post #19

Someone should make a site where you sign in with your Gmail account and find out how many of your contacts have youporn accounts.

I wouldn't trust a site like that with my Gmail contacts.

That was kind of part of the irony :)

Re: YouPorn passwords available for download, thousands of users exposed

#58

Post by spindritf »

jrockway wrote: post #30
rokhayakebe wrote: post #5

Why would anyone sign up for a porn site with their main email address? What baffles me even more is how some people actually whip out their credit card and give the digits to a porn site.

What baffles me even more is how some people actually whip out their credit card and give the digits to a porn site. Why? Most of the big porn studios are as trustworthy as any other Internet business of the same size, and if your credit card number is misused, you're not liable for the charges anyway. Porn popularized selling DRM-free content for money long before Louis CK made it popular. Porn actors need to pay th…

> Why? Most of the big porn studios are as trustworthy as any other Internet business of the same size

The probability of a leak may be similar but the downside isn't. It's no problem whatsoever if your name is linked to cheapprogrammingbooks.com, you cancel the card, get a new one. The situation is somewhat different for spermgarglingteens.com.

Re: YouPorn passwords available for download, thousands of users exposed

#59

Post by 16s »

outworlder wrote: post #34
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

The sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my atti…

The thing with password managers is that the most convenient ones store your data in a server somewhere. And that opens up more issues than it solves. For the ones that store information in a local file, that could work. But then a lot of the mobility is lost, even if you use something like Dropbox (you are not going to sync behind a corporate firewall, for instance). At least my brain is attached to my head and is v…

Try SHA1_Pass. I'm the author. It's open Source. Runs on Linux, Windows and Macs. It generates passwords, it does not store them.

Edit: Here's a link (no ads or other junk). http://16s.us/sha1_pass/

Re: YouPorn passwords available for download, thousands of users exposed

#60

Post by Sukotto »

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

I have a 50/50 chance of traveling through Montreal & Ottawa later this year. I'd love to buy you a coffee and pick your brain a bit about your tech stack and the IT challenges you've faced at YP. May I contact you?
Post reply on HN