Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YouPorn passwords available for download, thousands of users exposed

nakedsecurity.sophos.com

Post reply on HN
Print view View original

61–70 of 90 posts

Re: YouPorn passwords available for download, thousands of users exposed

#61

Post by dchest »

pjscott wrote: post #50
pbreit wrote: post #16

Earlier quoted context omitted.

Besides "use bcrypt" I've never really seen decent guidance on how to actually store passwords (what sort of salt to use, where to store the salt, if and where to store the hash method, how/where to store the key, etc).

I'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same. When a user gives you their password for the first time, here's what you store in your database: hashed_password = bcrypt.hashpw(password, bcrypt.gensalt()) Store hashed_password in your database for later. Then, when a user tries to log in, they will tell yo…

Your verification code is wrong. See http://codahale.com/a-lesson-in-timing-attacks/

Edit: I'm wrong, sorry.

Re: YouPorn passwords available for download, thousands of users exposed

#62

Post by pstatho »

Sukotto wrote: post #60
pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

I have a 50/50 chance of traveling through Montreal & Ottawa later this year. I'd love to buy you a coffee and pick your brain a bit about your tech stack and the IT challenges you've faced at YP. May I contact you?

Sure no problem. You can reach me at: pstatho at gmail

Re: YouPorn passwords available for download, thousands of users exposed

#63

Post by csoghoian »

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Were you the CTO at YouPorn back in 2010, when the company abused a flaw (css sniffing) in web browsers that allowed your company to covertly determine what other porn sites users had visited? See: http://www.forbes.com/sites/kashmirhill/2010/11/30/history-s...

Do you think that it was reasonable behavior to engage in without telling your users?

Re: YouPorn passwords available for download, thousands of users exposed

#64

Post by [deleted] »

dchest wrote: post #61
pjscott wrote: post #50

Earlier quoted context omitted.

I'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same. When a user gives you their password for the first time, here's what you store in your database: hashed_password = bcrypt.hashpw(password, bcrypt.gensalt()) Store hashed_password in your database for later. Then, when a user tries to log in, they will tell yo…

Your verification code is wrong. See http://codahale.com/a-lesson-in-timing-attacks/ Edit: I'm wrong, sorry.

[deleted]

Re: YouPorn passwords available for download, thousands of users exposed

#65

Post by pyre »

NelsonMinar wrote: post #35

Top 10 domains: 1469 yahoo.com / 1071 hotmail.com / 882 gmail.com / 205 hotmail.co.uk / 178 web.de / 136 gmx.de / 127 aol.com / 116 hotmail.de / 115 live.com / 104 hotmail.fr Top 10 passwords: 110 123456 / 75 123456789 / 30 12345 / 23 melinda / 19 fuck / 18 1234567890 / 17 Nightmare / 16 allzen / 15 password / 15 anal That's of about 6400 records.

I'm curious about these:

  23 melinda
  16 allzen
Seems odd that so many people would end up with those passwords. Maybe these represent multiple accounts by the same person?

Re: YouPorn passwords available for download, thousands of users exposed

#66

Post by ortatherox »

aaronpk wrote: post #57
rsanchez1 wrote: post #37

Earlier quoted context omitted.

I wouldn't trust a site like that with my Gmail contacts.

That was kind of part of the irony :)

with google's oauth you wouldn't have to give them access to your account ;)

Re: YouPorn passwords available for download, thousands of users exposed

#67

Post by pstatho »

csoghoian wrote: post #63
pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Were you the CTO at YouPorn back in 2010, when the company abused a flaw (css sniffing) in web browsers that allowed your company to covertly determine what other porn sites users had visited? See: http://www.forbes.com/sites/kashmirhill/2010/11/30/history-s... Do you think that it was reasonable behavior to engage in without telling your users?

No I wasn't, our company had no involvement with YouPorn at that time.

We spoke to the owners about the issue and they are really some of the nicest people we've met. They really did not have malicious intentions.

That issue brought the privacy flaw to the forefront, and certainly the adult industry pushes those limits. We always strive to respect industry best practices regarding privacy, especially around cookie handling. We constantly review privacy policies around the world.

Re: YouPorn passwords available for download, thousands of users exposed

#68

Post by tptacek »

dchest wrote: post #61
pjscott wrote: post #50

Earlier quoted context omitted.

I'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same. When a user gives you their password for the first time, here's what you store in your database: hashed_password = bcrypt.hashpw(password, bcrypt.gensalt()) Store hashed_password in your database for later. Then, when a user tries to log in, they will tell yo…

Your verification code is wrong. See http://codahale.com/a-lesson-in-timing-attacks/ Edit: I'm wrong, sorry.

Wait, what? What's the attack you're thinking of here? How would it actually work?

Re: YouPorn passwords available for download, thousands of users exposed

#69

Post by dchest »

tptacek wrote: post #68
dchest wrote: post #61

Earlier quoted context omitted.

Your verification code is wrong. See http://codahale.com/a-lesson-in-timing-attacks/ Edit: I'm wrong, sorry.

Wait, what? What's the attack you're thinking of here? How would it actually work?

Hah, you're right. It's practically impossible to generate passwords in such way that they will give hashes differing by only a byte. Sorry, I see timing attacks everywhere.

Re: YouPorn passwords available for download, thousands of users exposed

#70

Post by tptacek »

dchest wrote: post #69
tptacek wrote: post #68

Earlier quoted context omitted.

Wait, what? What's the attack you're thinking of here? How would it actually work?

Hah, you're right. It's practically impossible to generate passwords in such way that they will give hashes differing by only a byte. Sorry, I see timing attacks everywhere.

Have you actually ever written an exploit for one? It'll cure you of that problem really fast.

(I'm being serious, not snarky).

Post reply on HN