Change your Last.fm password • Hacker News Board

Re: Change your Last.fm password

#81

Post by toyg » Thu, Jun 07, 2012, 8:03 PM UTC

jameswyse wrote: post #60

@CrackMeIfYouCan posted this on twitter: A bit of stats on last.fm leak: 1) It happened a WHILE ago. 2010/2011 2) 17.3 million raw-md5 3) 16.4 million cracked. 95% cracked.

WTF, A YEAR AGO ?? They didn't notify users (i.e. me). Aren't they in breach of California law? Where are they based?

Re: Change your Last.fm password

#82

Post by toyg » Thu, Jun 07, 2012, 8:08 PM UTC

0x0 wrote: post #8

Do LinkedIn, eHarmony and LastFM have any parts of their software stack in common? Same 0day?

Apparently this breach is a year old, so nothing to do with it. Maybe they just decided to go public today hoping that focus would remain on LNKD or (even better) people would just think "ah well, it can happen to everybody".

Re: Change your Last.fm password

#83

Post by tomg » Thu, Jun 07, 2012, 8:13 PM UTC

anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

You can get rid of a huge amount of password-related frustration by using a good password manager (not the rinky-dink ones that browsers come built in with).

I've been very satisfied with 1Password and I can't imagine going back to not using it.

Re: Change your Last.fm password

#84

Post by hinathan » Thu, Jun 07, 2012, 8:27 PM UTC

jgrahamc wrote: post #73

Is there a cryptanalytic reason why a company that has a database full of MD5/SHA1 hashes can't perform a one time upgrade by computing bcrypt(salt, the_old_hash) for every hash they have in the database and then when someone logs in do bcrypt(salt, md5/sha1(password)) to check the password?

That's a perfectly reasonable approach — we did that at PBworks a long time ago. Totally transparent to users if done right. You can also declare password bankruptcy and zero out everything. That forces password resets for your entire user base. The latter approach doesn't go over so well with users or support staff but it is much simpler.

Re: Change your Last.fm password

#85

Post by jcromartie » Thu, Jun 07, 2012, 8:29 PM UTC

obituary_latte wrote: post #53

anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords. It indeed appears that the entire system is broken beyond repair. It seems like it is becoming the norm to expect to be exploited at some point so the de-facto preemption is to have someone to blame. As the manager of a datacenter we recently moved into said "we're here…

Many banks are encumbered by old mainframe systems that still do a lot of their computing. I don't know how much of that bubbles up through to the web interfaces we deal with, but I know many tellers and agents are still on green screens, or on interfaces that are just pretty wrappers to mainframe terminals.

Re: Change your Last.fm password

#86

Post by jcromartie » Thu, Jun 07, 2012, 8:32 PM UTC

TeMPOraL wrote: post #74

sliverstorm wrote: post #52

Earlier quoted context omitted.

I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. Fundamental flaw with that- you can't change your fingerprint if/when it is compromised.

On the other hand, it's much harder to crack a hashed thumprint image. [edit] evan_ is right, you don't hash scan images. The question is, how much usable bits of entropy you can extract from a thumbprint scan? Anyway, I retract my main point.

Definitely. A 256 x 256 pixel grayscale image (8 bits per pixel) is half a million bits of entropy... try cracking that on your botnet!

Although the real entropy of thumbprint images is likely to be much smaller, considering that they share many simliar pixels... but it's still unimaginably huge compared to a short alphanumeric password.

Re: Change your Last.fm password

#87

Post by evan_ » Thu, Jun 07, 2012, 8:47 PM UTC

TeMPOraL wrote: post #74

sliverstorm wrote: post #52

Earlier quoted context omitted.

I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. Fundamental flaw with that- you can't change your fingerprint if/when it is compromised.

On the other hand, it's much harder to crack a hashed thumprint image. [edit] evan_ is right, you don't hash scan images. The question is, how much usable bits of entropy you can extract from a thumbprint scan? Anyway, I retract my main point.

two thumbprint scans, even one right after another, won't be identical, so comparing hashes is pointless.

Re: Change your Last.fm password

#88

Post by evan_ » Thu, Jun 07, 2012, 8:47 PM UTC

toyg wrote: post #81

jameswyse wrote: post #60

@CrackMeIfYouCan posted this on twitter: A bit of stats on last.fm leak: 1) It happened a WHILE ago. 2010/2011 2) 17.3 million raw-md5 3) 16.4 million cracked. 95% cracked.

WTF, A YEAR AGO ?? They didn't notify users (i.e. me). Aren't they in breach of California law? Where are they based?

maybe they're just learning about it

Re: Change your Last.fm password

#89

Post by DrCatbox » Thu, Jun 07, 2012, 8:48 PM UTC

lanstein wrote: post #29

raverbashing wrote: post #19

Earlier quoted context omitted.

What?! This means next leak will be one million CRC32 password hashes? Or maybe LM hashes. Or crypt on old /etc/password files

ROT13?

Ive seen a legacy application still in use which puts the password in a (non-secure) cookie as ROT13 and cleartext in the db.

Re: Change your Last.fm password

#90

Post by phase_9 » Thu, Jun 07, 2012, 8:50 PM UTC

tomg wrote: post #83

anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

You can get rid of a huge amount of password-related frustration by using a good password manager (not the rinky-dink ones that browsers come built in with). I've been very satisfied with 1Password and I can't imagine going back to not using it.

I've just spent the last couple of hours creating unique longins for every site I can remember having a login for and storing them in Keepass (opensource password safe). The Keepass database is stored on my dropbox account so it's automatically synced to all machines / devices I use.

I get the impression this is going to be a bit of a PITA, but with the rate these sites are being breached it's probably a sensible move.