YouPorn passwords available for download, thousands of users exposed • Hacker News Board

Re: YouPorn passwords available for download, thousands of users exposed

#81

Post by drostie » Thu, Feb 23, 2012, 3:18 PM UTC

DomBlack wrote: post #80

daeken wrote: post #77

Earlier quoted context omitted.

A single round of a hash -- salted or not -- is simply broken in 2012. When you can rent time on a bunch of GPUs on EC2 for effectively nothing, breaking the vast majority of hashes takes no work at all. PBKDF2 with a large number of rounds (10000 recommended), bcrypt, or scrypt are a requirement IMO.

Do you have any links to articles regarding being able to easily crack a single round hash? I'm wondering what sort of time frame you'd be looking at for a single round password, i.e; md5(salt.cleartext)

There are about 252 trillion or 2^48 passwords consisting of 8 symbols drawn from (uppercase/lowercase letters + numbers + space). These are presently available in a downloadable lookup table which uses a compression method called 'rainbow tables' to store this information in just 350 GB, if I am reading these numbers correctly. There are similar lookup tables which include all 32 symbols accessible from the keyboard out to 7 characters, taking up 130 GB on disk. These speedups and compressions are made by large distributed computing projects, and would otherwise be out of the range of normal consumers -- but now that the lookup table has been generated, it can be pretty quickly queried, as I understand it.

Salting a hash is meant to stop precisely these attacks, and these numbers were taken for MD5 in particular from:

    http://tbhost.eu/rt.php?algorithm=2

However this also gives us a bound on what's possible. A large project with 10,000 users trying to brute-force passwords can brute force all 2^48 of these, and store them in a highly compressed fashion, in however long it takes to make these things (months?). In theory, no password with under 48 bits of entropy is truly safe from someone with access to, say, government-scale computation.

What's possible for the rest of us? I can use Node.js to encrypt a typical password using PBKDF2(HMAC-SHA1) like so:

     crypto.pbkdf2('sconesMultiply51', '0SGrf8KIZ', Math.pow(2, 17), 18, logger)

This takes 377 ms on my web server and calls SHA1 something like 2^18 times (twice for HMAC, 2^17 for the PBKDF parameter above), 255ms on my laptop. It's also a wrapper for an OpenSSL routine. So this should be about typical for C routines, and I should be able to do 2^20/s without GPU speedups. (That's 2^36 passwords/day.)

The above password 'sconesMultiply51' only has 40 bits of unpredictableness, so give me about two weeks, '0SGrf8KIZ', and sha1('0SGrf8KIZsconesMultiply51') and I can quite possibly find 'sconesMultiply51' by brute force on a laptop.

GPUs make things faster. This site:

    http://www.insidepro.com/eng/egb.shtml

reports doing sha1($pass.$salt) 80 million times per second on an older GPU (an nVidia GTS250). So they can get 2^26/s. If they're right, then they could hypothetically find 'sconesMultiply51' in under a day, as long as you reconfigured them to start searching words from a 10,000-word dictionary which might optionally be capitalized, rather than individual characters.

What's the absolute upper bound? Well, thankfully, the biggest public supercomputers are actually very well-known and published on top500.org. The absolute top of the line today is this beast:

    http://i.top500.org/system/177232

It does 2^53 floating point operations per second. Assuming a hash is something like 100 or 1000 operations, you'd still have 2^43-2^46 tries per second. That's probably an upper limit on what your typical government can do, as well.

Lessons: (1) you'll be safe for the next 20 years at least if you just get used to

    head -c 9 /dev/urandom | base64 | sed 's/+/_/g;s/\//-/g'

and the 12-character passwords that result. (2) you can give people about 16-20 bits of extra security if you use key stretching techniques, but that's about it.

Re: YouPorn passwords available for download, thousands of users exposed

#82

Post by zaidf » Thu, Feb 23, 2012, 4:05 PM UTC

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Can you elaborate on what you mean when you state that chat.youporn was operated by another entity?

So you guys cut a deal with another entity to let em "rent" the subdomain chat.youporn? Just intrigued by how this works.

Re: YouPorn passwords available for download, thousands of users exposed

#83

Post by b00gizm » Thu, Feb 23, 2012, 4:16 PM UTC

zaidf wrote: post #82

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Can you elaborate on what you mean when you state that chat.youporn was operated by another entity? So you guys cut a deal with another entity to let em "rent" the subdomain chat.youporn? Just intrigued by how this works.

It's a common practice to "rent" content from 3rd parties. You (as rentee) get your cut by affiliation or minutes fee.

Re: YouPorn passwords available for download, thousands of users exposed

#84

Post by zaidf » Thu, Feb 23, 2012, 4:50 PM UTC

b00gizm wrote: post #83

zaidf wrote: post #82

Earlier quoted context omitted.

Can you elaborate on what you mean when you state that chat.youporn was operated by another entity? So you guys cut a deal with another entity to let em "rent" the subdomain chat.youporn? Just intrigued by how this works.

It's a common practice to "rent" content from 3rd parties. You (as rentee) get your cut by affiliation or minutes fee.

"...but they are not affiliated at all. It was operated by a completely separate entity"

Well if what you say is true, then it seems like they are affiliated and the CTO's above statement seems off. Of course you can be a separate entity and still be affiliated.

I would say "not affiliated" if said company was just paying them a flat fee per month to run their stuff on a subdomain. If they are, however, getting a percentage of revenue, it's a classic affiliate model.

Re: YouPorn passwords available for download, thousands of users exposed

#85

Post by pstatho » Thu, Feb 23, 2012, 5:06 PM UTC

zaidf wrote: post #82

pstatho wrote: post #28

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably…

Can you elaborate on what you mean when you state that chat.youporn was operated by another entity? So you guys cut a deal with another entity to let em "rent" the subdomain chat.youporn? Just intrigued by how this works.

The 3rd party sells their service, which is web-based chat application, to any company. Think of it as a company that offers hosted forums (SaaS model), but chats instead of forums. It allowed Youporn to offer a chat service to users, without us having to develop and maintain it. Again this decision was done before we took over.

Using chat.youporn.com is not that different than using ypchat.com, personally I would have preferred the latter for obvious reasons.

Re: YouPorn passwords available for download, thousands of users exposed

#86

Post by pstatho » Thu, Feb 23, 2012, 5:11 PM UTC

zaidf wrote: post #84

b00gizm wrote: post #83

Earlier quoted context omitted.

It's a common practice to "rent" content from 3rd parties. You (as rentee) get your cut by affiliation or minutes fee.

"...but they are not affiliated at all. It was operated by a completely separate entity" Well if what you say is true, then it seems like they are affiliated and the CTO's above statement seems off. Of course you can be a separate entity and still be affiliated. I would say "not affiliated" if said company was just paying them a flat fee per month to run their stuff on a subdomain. If they are, however, getting a per…

I don't know the financial deal that is in place, but I don't see how it impacts the affiliation.

From my perspective the accounts are not shared, so you needed to register there to create an account. We don't share databases. Also, it is not our company and operates completely independent from us. This is what I meant by not affiliated. Hope that clears it up.

Re: YouPorn passwords available for download, thousands of users exposed

#87

Post by rplnt » Thu, Feb 23, 2012, 5:37 PM UTC

drostie wrote: post #81

DomBlack wrote: post #80

Earlier quoted context omitted.

Do you have any links to articles regarding being able to easily crack a single round hash? I'm wondering what sort of time frame you'd be looking at for a single round password, i.e; md5(salt.cleartext)

There are about 252 trillion or 2^48 passwords consisting of 8 symbols drawn from (uppercase/lowercase letters + numbers + space). These are presently available in a downloadable lookup table which uses a compression method called 'rainbow tables' to store this information in just 350 GB, if I am reading these numbers correctly. There are similar lookup tables which include all 32 symbols accessible from the keyboard…

Bad thing is that you can't really use hashing function that takes quarter a second to complete in service with many(many!) users.

Re: YouPorn passwords available for download, thousands of users exposed

#88

Post by zaidf » Thu, Feb 23, 2012, 7:19 PM UTC

pstatho wrote: post #86

zaidf wrote: post #84

Earlier quoted context omitted.

"...but they are not affiliated at all. It was operated by a completely separate entity" Well if what you say is true, then it seems like they are affiliated and the CTO's above statement seems off. Of course you can be a separate entity and still be affiliated. I would say "not affiliated" if said company was just paying them a flat fee per month to run their stuff on a subdomain. If they are, however, getting a per…

I don't know the financial deal that is in place, but I don't see how it impacts the affiliation. From my perspective the accounts are not shared, so you needed to register there to create an account. We don't share databases. Also, it is not our company and operates completely independent from us. This is what I meant by not affiliated. Hope that clears it up.

Appreciate your answer. Parts of your post make it seem like you have next to nothing to do with this; while other parts make it seem like you do have responsibility for this.

Also, it is not our company and operates completely independent from us.

Do you mean by this that the SaaS chat application deployed at chat.youporn.com is developed by a different entity to youporn? If so, then I understand the different entity part. But does that entity also own the users and serve its own TOS than you guys for chat.youporn users? If you are merely deploying a SaaS but have your own TOS and own the users, then it seems like while YouPorn may not be at fault for the technical goof up, but you are still responsible overall since the users belonged to YouPorn(not the parent entity).

Re: YouPorn passwords available for download, thousands of users exposed

#89

Post by rhizome » Thu, Feb 23, 2012, 8:17 PM UTC

pstatho wrote: post #43

rhizome wrote: post #39

Earlier quoted context omitted.

Something about that URL tells me you didn't always mind if people associated the two together.

I suppose at some point the old owners did want to make that association. That deal was in place since 2008, we've been managing it for less than a year now. We've been focusing on the rewrite of the main site and are now cleaning up all the secondary dependencies.

Nothing personal, but is there something about the industry that causes you to be evasive and use weasel words? It doesn't seem controversial that giving a company a subdomain on your site implies an associative connection, not just "I suppose..." SRS Q.

Re: YouPorn passwords available for download, thousands of users exposed

#90

Post by thirsteh » Thu, Feb 23, 2012, 8:25 PM UTC

rplnt wrote: post #87

drostie wrote: post #81

Earlier quoted context omitted.

There are about 252 trillion or 2^48 passwords consisting of 8 symbols drawn from (uppercase/lowercase letters + numbers + space). These are presently available in a downloadable lookup table which uses a compression method called 'rainbow tables' to store this information in just 350 GB, if I am reading these numbers correctly. There are similar lookup tables which include all 32 symbols accessible from the keyboard…

Bad thing is that you can't really use hashing function that takes quarter a second to complete in service with many(many!) users.

Of course you can. You only need it for the initial login.