Change your Last.fm password

#1

Post by luiperd » Thu, Jun 07, 2012, 4:50 PM UTC

Change your Last.fm password
thenextweb.com

Re: Change your Last.fm password

#2

Post by tptacek » Thu, Jun 07, 2012, 5:04 PM UTC

17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.

Re: Change your Last.fm password

#3

Post by jgrahamc » Thu, Jun 07, 2012, 5:07 PM UTC

tptacek wrote: post #2

17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.

Says who? Not that I don't believe you.

EDIT: The developer who apparently implemented the password hashing replied to me on Twitter: https://twitter.com/russss/status/210783976879693824

Re: Change your Last.fm password

#4

Post by tptacek » Thu, Jun 07, 2012, 5:13 PM UTC

jgrahamc wrote: post #3

tptacek wrote: post #2

17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.

Says who? Not that I don't believe you. EDIT: The developer who apparently implemented the password hashing replied to me on Twitter: https://twitter.com/russss/status/210783976879693824

Says these people:

http://contest.korelogic.com/

Check out the twerps at @CrackMeIfYouCan.

Re: Change your Last.fm password

#5

Post by hpaavola » Thu, Jun 07, 2012, 5:16 PM UTC

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

Re: Change your Last.fm password

#6

Post by jgrahamc » Thu, Jun 07, 2012, 5:18 PM UTC

tptacek wrote: post #4

jgrahamc wrote: post #3

Earlier quoted context omitted.

Says who? Not that I don't believe you. EDIT: The developer who apparently implemented the password hashing replied to me on Twitter: https://twitter.com/russss/status/210783976879693824

Says these people: http://contest.korelogic.com/ Check out the twerps at @CrackMeIfYouCan.

Thanks. That's good enough for me. So, last.fm gets added to the list of companies that don't care about their users' security but say they do.

Re: Change your Last.fm password

#7

Post by markkum » Thu, Jun 07, 2012, 5:20 PM UTC

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

If you want something better for your site; check out MePIN https://www.mepin.com/

Re: Change your Last.fm password

#8

Post by 0x0 » Thu, Jun 07, 2012, 5:22 PM UTC

Do LinkedIn, eHarmony and LastFM have any parts of their software stack in common? Same 0day?

Re: Change your Last.fm password

#9

Post by ig1 » Thu, Jun 07, 2012, 5:24 PM UTC

0x0 wrote: post #8

Do LinkedIn, eHarmony and LastFM have any parts of their software stack in common? Same 0day?

They're all Hadoop users.

Re: Change your Last.fm password

#10

Post by quesera » Thu, Jun 07, 2012, 5:26 PM UTC

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

Well, the problem here is that big corps are doing obviously-wrong things with user data. It's not like there's any uncertainty in the industry about how to do things correctly, it's just that these corps and many others are deciding not to.

What makes you think they would make better decisions if the technology was called something other than "passwords"?

There is no technology that cannot be ruined by ignorant implementation.

Passwords suck for other reasons. This is a poor example.