Change your Last.fm password

Post by mnicole » Thu, Jun 07, 2012, 7:13 PM UTC

pclark wrote: post #27

jasonkester wrote: post #20

Last.fm sounds like the canonical example of a site that where it makes absolutely no difference if your password gets exposed. Worst case, some malicious individual on the internet will learn that I still like the Beastie Boys, even though it's not 1994 anymore. And possibly they'll listen to music in my name. This is why one has a throwaway password. For throwaway accounts at throwaway sites like this. Getting your…

I have over 150k songs scrobbled to Last.FM and have been a member since 2005. I actually can think of very few other services that I would care as much as if my Last.FM was compromised/deleted.

Post by jgrahamc » Thu, Jun 07, 2012, 7:17 PM UTC

Post by jedbrown » Thu, Jun 07, 2012, 7:37 PM UTC

soulclap wrote: post #70

jedbrown wrote: post #62

Earlier quoted context omitted.

Unsalted was not "state of the art" in the 1970s. The database would be far more secure if it had used a weaker hash with salt. To migrate, Unix-like systems generally support database migration through a modular format (see "man pam_unix" and /etc/pam.d/passwd). The next time the password is changed, the field that looks like $1$ $ will be converted to $6$ $ . I guess you could change it at the next login if you all…

You are right, I just meant to say that the 'awareness' has increased a lot since Last.fm first stepped on the scene. Unless you were already security-savvy and had a hacker (as in the original sense of the word) background, I guess no one really cared back then. On a sidenote, I just changed passwords for what was probably my second last.fm account and I haven't logged in or 'scrobbled' since 2007. Different times f…

Post by joelthelion » Thu, Jun 07, 2012, 7:44 PM UTC

jgrahamc wrote: post #73

Is there a cryptanalytic reason why a company that has a database full of MD5/SHA1 hashes can't perform a one time upgrade by computing bcrypt(salt, the_old_hash) for every hash they have in the database and then when someone logs in do bcrypt(salt, md5/sha1(password)) to check the password?

Post by kalininalex » Thu, Jun 07, 2012, 7:54 PM UTC

jameswyse wrote: post #60

@CrackMeIfYouCan posted this on twitter: A bit of stats on last.fm leak: 1) It happened a WHILE ago. 2010/2011 2) 17.3 million raw-md5 3) 16.4 million cracked. 95% cracked.