Change your Last.fm password • Hacker News Board

Re: Change your Last.fm password

#11

Post by pnathan » Thu, Jun 07, 2012, 5:27 PM UTC

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

I would like to see pub/private key implementations for this sort of thing.

Re: Change your Last.fm password

#12

Post by flyt » Thu, Jun 07, 2012, 5:36 PM UTC

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

Easy: everybody authenticate with Facebook Connect, then we just have a single location and storage mechanism to secure.

Re: Change your Last.fm password

#13

Post by [deleted] » Thu, Jun 07, 2012, 5:39 PM UTC

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

[deleted]

Re: Change your Last.fm password

#14

Post by dchest » Thu, Jun 07, 2012, 5:40 PM UTC

flyt wrote: post #12

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

Easy: everybody authenticate with Facebook Connect, then we just have a single location and storage mechanism to secure.

Ha-ha. And nothing goes wrong.

Re: Change your Last.fm password

#15

Post by ronnoch » Thu, Jun 07, 2012, 5:40 PM UTC

I was worried for a minute, but I can't actually think of anything a hacker could do with my last.fm account that I care about.

Re: Change your Last.fm password

#16

Post by pavel_lishin » Thu, Jun 07, 2012, 5:45 PM UTC

pnathan wrote: post #11

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

I would like to see pub/private key implementations for this sort of thing.

I find it so odd that this functionality wasn't baked into web browsers from the beginning.

Re: Change your Last.fm password

#17

Post by timdorr » Thu, Jun 07, 2012, 5:46 PM UTC

ig1 wrote: post #9

0x0 wrote: post #8

Do LinkedIn, eHarmony and LastFM have any parts of their software stack in common? Same 0day?

They're all Hadoop users.

I doubt their Hadoop clusters have password data stored in them.

Re: Change your Last.fm password

#18

Post by joshuahedlund » Thu, Jun 07, 2012, 5:47 PM UTC

flyt wrote: post #12

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

Easy: everybody authenticate with Facebook Connect, then we just have a single location and storage mechanism to secure.

s/secure/crack.

Re: Change your Last.fm password

#19

Post by raverbashing » Thu, Jun 07, 2012, 5:47 PM UTC

tptacek wrote: post #2

17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.

What?!

This means next leak will be one million CRC32 password hashes?

Or maybe LM hashes. Or crypt on old /etc/password files

Re: Change your Last.fm password

#20

Post by jasonkester » Thu, Jun 07, 2012, 5:49 PM UTC

Last.fm sounds like the canonical example of a site that where it makes absolutely no difference if your password gets exposed.

Worst case, some malicious individual on the internet will learn that I still like the Beastie Boys, even though it's not 1994 anymore. And possibly they'll listen to music in my name.

This is why one has a throwaway password. For throwaway accounts at throwaway sites like this. Getting your throwaway password thrown away should by definition not be something you worry about.