Change your Last.fm password • Hacker News Board

Re: Change your Last.fm password

#21

Post by tptacek » Thu, Jun 07, 2012, 5:49 PM UTC

raverbashing wrote: post #19

tptacek wrote: post #2

17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.

What?! This means next leak will be one million CRC32 password hashes? Or maybe LM hashes. Or crypt on old /etc/password files

This was funny, and I laughed, but the irony is that old Unix crypt(3) is probably better than MD5 or SHA1.

Re: Change your Last.fm password

#22

Post by jen_h » Thu, Jun 07, 2012, 5:49 PM UTC

timdorr wrote: post #17

ig1 wrote: post #9

Earlier quoted context omitted.

They're all Hadoop users.

I doubt their Hadoop clusters have password data stored in them.

It would be very foolish, but I do wonder if they used Hadoop to compare their hashes with publicly exposed hashes after breaches of other sites (for example, Gawker or Zappos) in order to force reset affected users.

Re: Change your Last.fm password

#23

Post by georgespencer » Thu, Jun 07, 2012, 5:50 PM UTC

Does anyone have a dump of the hashes?

Re: Change your Last.fm password

#24

Post by jgrahamc » Thu, Jun 07, 2012, 5:51 PM UTC

raverbashing wrote: post #19

tptacek wrote: post #2

17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.

What?! This means next leak will be one million CRC32 password hashes? Or maybe LM hashes. Or crypt on old /etc/password files

Well, the Gawker hack was DES IIRC.

Re: Change your Last.fm password

#25

Post by benpbenp » Thu, Jun 07, 2012, 5:51 PM UTC

0x0 wrote: post #8

Do LinkedIn, eHarmony and LastFM have any parts of their software stack in common? Same 0day?

Or perhaps some eHarmony and LastFM employees used sensitive passwords for their LinkedIn accounts.

Re: Change your Last.fm password

#26

Post by pimeys » Thu, Jun 07, 2012, 5:52 PM UTC

jasonkester wrote: post #20

Last.fm sounds like the canonical example of a site that where it makes absolutely no difference if your password gets exposed. Worst case, some malicious individual on the internet will learn that I still like the Beastie Boys, even though it's not 1994 anymore. And possibly they'll listen to music in my name. This is why one has a throwaway password. For throwaway accounts at throwaway sites like this. Getting your…

They'll get your username, they might crack your password.

Do you use the same password/username combination somewhere else? If not, good for you. You're kind of a rare person.

Re: Change your Last.fm password

#27

Post by pclark » Thu, Jun 07, 2012, 5:54 PM UTC

jasonkester wrote: post #20

Last.fm sounds like the canonical example of a site that where it makes absolutely no difference if your password gets exposed. Worst case, some malicious individual on the internet will learn that I still like the Beastie Boys, even though it's not 1994 anymore. And possibly they'll listen to music in my name. This is why one has a throwaway password. For throwaway accounts at throwaway sites like this. Getting your…

I have over 150k songs scrobbled to Last.FM and have been a member since 2005. I actually can think of very few other services that I would care as much as if my Last.FM was compromised/deleted.

Re: Change your Last.fm password

#28

Post by waffle_ss » Thu, Jun 07, 2012, 5:55 PM UTC

hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

I like using OpenID. I just use my domain name as a delegate and point it at my current OpenID provider of choice for authentication (which is currently my Google profile; used to be myOpenID 'til they went down for 1/2 a day). As long as I retain my domain name, I can control authentication, even if my current provider were to be compromised (just point my domain name/delegate at a different provider).

The problem, of course, is a lot of sites still don't support OpenID.

Re: Change your Last.fm password

#29

Post by lanstein » Thu, Jun 07, 2012, 5:56 PM UTC

raverbashing wrote: post #19

tptacek wrote: post #2

17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.

What?! This means next leak will be one million CRC32 password hashes? Or maybe LM hashes. Or crypt on old /etc/password files

ROT13?

Re: Change your Last.fm password

#30

Post by chc » Thu, Jun 07, 2012, 5:56 PM UTC

pimeys wrote: post #26

jasonkester wrote: post #20

Last.fm sounds like the canonical example of a site that where it makes absolutely no difference if your password gets exposed. Worst case, some malicious individual on the internet will learn that I still like the Beastie Boys, even though it's not 1994 anymore. And possibly they'll listen to music in my name. This is why one has a throwaway password. For throwaway accounts at throwaway sites like this. Getting your…

They'll get your username, they might crack your password. Do you use the same password/username combination somewhere else? If not, good for you. You're kind of a rare person.

Even if you don't use the same username, if they have your email, those are fungible with usernames on many sites. (And of course game over if you use the same or similar password for Last.fm and email.)