Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Change your Last.fm password

thenextweb.com

Post reply on HN
Print view View original

61–70 of 152 posts

Re: Change your Last.fm password

#61

Post by mikeash »

soulclap wrote: post #43

To be 'fair': when Last.fm first launched, md5 was probably 'state of the art'. I mean take a step back, they have been around for like forever. The question is: How would you go on about moving your user database from md5 to a more advanced algorithm? Validate a user's password on log-in and then encrypt it with the new, more secure algorithm?

I don't believe straight unsalted MD5 was ever state of the art for password hashing. Yes, it was a state of the art cryptographic hash at one point, but those are not the same thing.

Re: Change your Last.fm password

#62

Post by jedbrown »

soulclap wrote: post #43

To be 'fair': when Last.fm first launched, md5 was probably 'state of the art'. I mean take a step back, they have been around for like forever. The question is: How would you go on about moving your user database from md5 to a more advanced algorithm? Validate a user's password on log-in and then encrypt it with the new, more secure algorithm?

Unsalted was not "state of the art" in the 1970s. The database would be far more secure if it had used a weaker hash with salt.

To migrate, Unix-like systems generally support database migration through a modular format (see "man pam_unix" and /etc/pam.d/passwd). The next time the password is changed, the field that looks like $1$$ will be converted to $6$$. I guess you could change it at the next login if you allowed modification to the password table during login. If you were eager, you could just salt and rehash the hashes current hashes. To check that password, you would do the old unsalted md5, then apply the salt and sha512 (or whatever) before checking in the database.

Re: Change your Last.fm password

#64

Post by ihatecats »

quesera wrote: post #10
hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

Well, the problem here is that big corps are doing obviously-wrong things with user data. It's not like there's any uncertainty in the industry about how to do things correctly, it's just that these corps and many others are deciding not to. What makes you think they would make better decisions if the technology was called something other than "passwords"? There is no technology that cannot be ruined by ignorant impl…

> Well, the problem here is that big corps are doing obviously-wrong things with user data

Totally true. One service of a rather large European bank stores passwords in plain text. It's just waiting to be exploited.

Re: Change your Last.fm password

#65

Post by wdewind »

obituary_latte wrote: post #53
anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords. It indeed appears that the entire system is broken beyond repair. It seems like it is becoming the norm to expect to be exploited at some point so the de-facto preemption is to have someone to blame. As the manager of a datacenter we recently moved into said "we're here…

I also have Chase and have heard the explanation for not allowing symbols in passwords to be that they are harder to grep out of logs if someone is keylogging you. Seems like BS to me, but either way is is extraordinarily frustrating to not be able to use a strong password for your bank.

Something even more ridiculous Chase does is assign a default pin of '3210' to checking accounts.

Re: Change your Last.fm password

#66

Post by drostie »

jameswyse wrote: post #60

@CrackMeIfYouCan posted this on twitter: A bit of stats on last.fm leak: 1) It happened a WHILE ago. 2010/2011 2) 17.3 million raw-md5 3) 16.4 million cracked. 95% cracked.

Nice to hear. I had thought that perhaps one of their higher-ups had used the same pass on LinkedIn as on Last.fm and had noticed suspicious activity. Now I know that they just googled to see, "oh, did anyone hack us? they did?! OVER A YEAR AGO?!"

Re: Change your Last.fm password

#67

Post by soulclap »

cschmidt wrote: post #56
soulclap wrote: post #51

Earlier quoted context omitted.

Great feature. So you alter the password field (extending the length) if needed and when a user signs in it gets auto-updated and Django always tests both/all specified algorithms? Or do you have to add a new database field when moving on? (Sorry for my tl;dr behaviour but while I've got an expert on the line anyway...)

I'm not an expert in any sense, just a Django user. I've never actually looked under the hood, since it just works. You specify an order of the hash algorithms, putting the one you want first. Switching to bcrypt for me was just a matter of moving it up a few lines in a list. The password field can probably stay the same length, since it is a hash value anyway. I'm assuming you have a second field that stores the has…

thanks for the insight, much appreciated. never really thought about how to do this before. (screams for a 'website security patterns' book.)

Re: Change your Last.fm password

#68

Post by cydonian_monk »

obituary_latte wrote: post #53
anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords. It indeed appears that the entire system is broken beyond repair. It seems like it is becoming the norm to expect to be exploited at some point so the de-facto preemption is to have someone to blame. As the manager of a datacenter we recently moved into said "we're here…

At last Chase allows us to have rather long passphrases (mine is well over 16 characters). Discover has the same alphanumeric-only rule, but limits you to 10 characters. 10. Then we have the silly little sites that don't retain any important information aside from a contact email that force you to have high entropy and two-byte non-latin characters in your password. (OK, so that's an exageration, but not much of one.)

Re: Change your Last.fm password

#69

Post by EvilTerran »

pek wrote: post #50
cschmidt wrote: post #44

Earlier quoted context omitted.

Yes, that's exactly what you do. In Django 1.4 (the latest), they store passwords using PDKDF2 or bcrypt. The nice thing is that it automatically upgrades the hash function if it used to be something else: _______ Password upgrading When users log in, if their passwords are stored with anything other than the preferred algorithm, Django will automatically upgrade the algorithm to the preferred one. This means that ol…

Couldn't you just move from, say, using MD5(password) to bcrypt(MD5(password))? So when it becomes apparent that the old hash is no more secure, start using the combination of the old bad hash (MD5) and the new good hash (bcrypt). This way you can simply run once through the password database, hash each password hash there with the new better hash, and throw away the old hashes. No need to prolong the process until t…

As hashing functions aren't injective, composing them leads to a reduction of range (ie, a smaller set of possible output values). As such, (bcrypt . MD5) would almost certainly be a weaker hash than bcrypt alone. Might not be enough to make a difference, but I'd consult a cryptologist before betting on that.

Re: Change your Last.fm password

#70

Post by soulclap »

jedbrown wrote: post #62
soulclap wrote: post #43

To be 'fair': when Last.fm first launched, md5 was probably 'state of the art'. I mean take a step back, they have been around for like forever. The question is: How would you go on about moving your user database from md5 to a more advanced algorithm? Validate a user's password on log-in and then encrypt it with the new, more secure algorithm?

Unsalted was not "state of the art" in the 1970s. The database would be far more secure if it had used a weaker hash with salt. To migrate, Unix-like systems generally support database migration through a modular format (see "man pam_unix" and /etc/pam.d/passwd). The next time the password is changed, the field that looks like $1$ $ will be converted to $6$ $ . I guess you could change it at the next login if you all…

You are right, I just meant to say that the 'awareness' has increased a lot since Last.fm first stepped on the scene. Unless you were already security-savvy and had a hacker (as in the original sense of the word) background, I guess no one really cared back then.

On a sidenote, I just changed passwords for what was probably my second last.fm account and I haven't logged in or 'scrobbled' since 2007. Different times for sure.

Post reply on HN