EHarmony Confirms Password Hack
pcmag.com
EHarmony Confirms Password Hack
1–10 of 33 posts
Re: EHarmony Confirms Password Hack
#2What a strange week for security.
Re: EHarmony Confirms Password Hack
#3If this is part of the same attack that hit LinkedIn and Last.fm are there any theories on what the exploit was? I'm having a hard time imagining how someone could steal passwords from 3 large, completely independent web services at the same time.
Re: EHarmony Confirms Password Hack
#4If this is part of the same attack that hit LinkedIn and Last.fm are there any theories on what the exploit was? I'm having a hard time imagining how someone could steal passwords from 3 large, completely independent web services at the same time.
It's possible that these were accumulated at very different times, by very different exploits, and possibly by very different people, and ended up in the hands of one group that released them together.
I saw speculation that the easy to break ones have already been long broken and exploited, and this release is the ones that weren't easy. That could explain why all three were dumped at the same time...they basically just went through and dumped the ones they couldn't use from all of the accumulated lists.
Re: EHarmony Confirms Password Hack
#5I have to imagine that this will open the potential for a viral website of the "is your spouse still playing the field" variety.
Re: EHarmony Confirms Password Hack
#6Couldn't password databases be implemented as hardened "appliances?" This wouldn't have to be sold as hardware, it could just be an install.
The machine would only have the function of storing and verifying passwords, and secure communication with authorized clients. All apis could use fixed-length fields.
Passwords themselves could be stored using a modified salting technique using a white-box version of block cipher. This would make it much harder for attackers to crack the password database.
The block cipher used for the modified salt could also be implemented by separate hardware, which would make it much harder to crack the password database.
Re: EHarmony Confirms Password Hack
#7Couldn't password databases be implemented as hardened "appliances?" This wouldn't have to be sold as hardware, it could just be an install. The machine would only have the function of storing and verifying passwords, and secure communication with authorized clients. All apis could use fixed-length fields. Passwords themselves could be stored using a modified salting technique using a white-box version of block ciphe…
That seems like it would be just as much work (and just as prone to errors) as building it right in the first place.
Re: EHarmony Confirms Password Hack
#8Is this newfound outpouring of confirmed hacks a result of the market becoming more blasé about leaked passwords, or is this just a statistical anomale?
Re: EHarmony Confirms Password Hack
#9Couldn't password databases be implemented as hardened "appliances?" This wouldn't have to be sold as hardware, it could just be an install. The machine would only have the function of storing and verifying passwords, and secure communication with authorized clients. All apis could use fixed-length fields. Passwords themselves could be stored using a modified salting technique using a white-box version of block ciphe…
I think if you care enough about password security to know these appliances exist, you already know how to use a proper password storage scheme. The ones that we are seeing dumped were not even trying.
Re: EHarmony Confirms Password Hack
#10Is this newfound outpouring of confirmed hacks a result of the market becoming more blasé about leaked passwords, or is this just a statistical anomale?
Eclipse? Transit of Venus?*
* (I know, I know: Wrong crowd. But take it as a tongue in cheek way of saying that it could be a "trend" with another explanation than either of the two you posit.)