Change your Last.fm password • Hacker News Board

Re: Change your Last.fm password

#101

Post by ghshephard » Thu, Jun 07, 2012, 9:27 PM UTC

cf0ed2aa-bdf5 wrote: post #93

obituary_latte wrote: post #53

Earlier quoted context omitted.

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords. It indeed appears that the entire system is broken beyond repair. It seems like it is becoming the norm to expect to be exploited at some point so the de-facto preemption is to have someone to blame. As the manager of a datacenter we recently moved into said "we're here…

My (German) bank only allows passwords up to 5 characters. When I ranted about it on twitter some IT guy from a local branch commented about that is totally enough since they do an hour lockout after 3 wrong tries. I'm thinking about switching banks now...

Well - keep in mind the following:

o Your German bank may have your password stored in an Utimaco/Sophos Hardware-attack-resistant keysafe, not hanging out in some linux hash file.

o If they lock you out after 3 tries, and the keyspace is [a-zA-Z0-9] - that's 916,132,832 combination, and only three attempts to get it right before being locked out.

On the surface, it sounds much less secure, but, depending on their procedures and hardware, it might be significantly more secure than a 9 character password that goes into a hash file that is software accessible.

Of course - better case - is a Hardware key safe that lets me store my 30 character 1password random password.

Re: Change your Last.fm password

#102

Post by timjahn » Thu, Jun 07, 2012, 9:38 PM UTC

jedbrown wrote: post #76

jgrahamc wrote: post #73

Is there a cryptanalytic reason why a company that has a database full of MD5/SHA1 hashes can't perform a one time upgrade by computing bcrypt(salt, the_old_hash) for every hash they have in the database and then when someone logs in do bcrypt(salt, md5/sha1(password)) to check the password?

It looks like that is what LinkedIn claims to have done. http://blog.linkedin.com/2012/06/06/linkedin-member-password...

"...which includes hashing and salting of our current password databases."

Does this mean before this leak, they didn't hash/salt passwords?

Re: Change your Last.fm password

#103

Post by astine » Thu, Jun 07, 2012, 9:38 PM UTC

sliverstorm wrote: post #52

anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. Fundamental flaw with that- you can't change your fingerprint if/when it is compromised.

Just switch fingers.

Re: Change your Last.fm password

#104

Post by dunk010 » Thu, Jun 07, 2012, 9:42 PM UTC

jgrahamc wrote: post #73

Is there a cryptanalytic reason why a company that has a database full of MD5/SHA1 hashes can't perform a one time upgrade by computing bcrypt(salt, the_old_hash) for every hash they have in the database and then when someone logs in do bcrypt(salt, md5/sha1(password)) to check the password?

The auth.getMobileSession method in the 2.0 API, and the scrobble 1.0 API were both sticking points.

Re: Change your Last.fm password

#105

Post by 7952 » Thu, Jun 07, 2012, 9:54 PM UTC

pnathan wrote: post #97

7952 wrote: post #58

Earlier quoted context omitted.

TLS does allow client authentication using keys. It is a flawed solution as it puts too much importance in protecting the key. What happens when you need to login from an internet cafe? How do you securely move keys between devices? What happens when the machine has malware that steal the keys? Good security assumes that everything can and will be compromised and provides defence in depth. Client certs do little to h…

That problem is pervasive with any sort of private key system, as well as the password databases becoming popular. Private key files pose a challenge, absolutely. But is it so much worse than having every company Jack store passwords in $non_crypto_hash_system? (begin-rumination.... Right now, compromise risk for credentials typically lies on the companies. They frequently fail in protecting these credentials. Howeve…

Perhaps a possible solution is to generate a private key in the browser using an algorithm such as PBKDF2 or bcrypt operating against a public per-user salt and a high entropy password. The private key is only kept in the clients memory long enough to sign something for the server.

This is not the best possible solution but I can't see how it would be worse than a compromised salt/bcrypt hash.

Re: Change your Last.fm password

#106

Post by jedbrown » Thu, Jun 07, 2012, 9:58 PM UTC

timjahn wrote: post #102

jedbrown wrote: post #76

Earlier quoted context omitted.

It looks like that is what LinkedIn claims to have done. http://blog.linkedin.com/2012/06/06/linkedin-member-password...

"...which includes hashing and salting of our current password databases." Does this mean before this leak, they didn't hash/salt passwords?

Yes, all the passwords in LinkedIn's massive leak were unsalted.

Re: Change your Last.fm password

#107

Post by niels_olson » Thu, Jun 07, 2012, 9:59 PM UTC

mtkd wrote: post #31

jasonkester wrote: post #20

Last.fm sounds like the canonical example of a site that where it makes absolutely no difference if your password gets exposed. Worst case, some malicious individual on the internet will learn that I still like the Beastie Boys, even though it's not 1994 anymore. And possibly they'll listen to music in my name. This is why one has a throwaway password. For throwaway accounts at throwaway sites like this. Getting your…

It matters because there was a failure and it could be in a technology or service you also use. It matters because many users re-use credentials. Scenario: You send a confidential email to a colleague, colleague has her lastfm compromised. Attacker scripts up logins against all common sites - including her Gmail account where you sent your confidential email. Script not only logs in and changes password, it also forw…

anyone care to bet everyone with a linkedin account who works at a tech company just got targetted attacks? Hi, my name is Joe Hacker, and I work at ! Since you got my linkedin account, why not try that password at admin.?

Re: Change your Last.fm password

#108

Post by guelo » Thu, Jun 07, 2012, 10:32 PM UTC

Here's the method I use to manage website passwords: For logins that I don't really care about that much, say last.fm, I use my standard medium-strength 6 character password with a number and a capital letter, something like jfi3Jo. I can remember it because I use it often. For logins that I do care about like my email or bank I salt my base password by inserting three characters from the site's domain name into the front, middle and end of the base password. For example, my login to Hacker News would be yjfic3Joo, where yco from ycombinator.com is added in the front middle and end of the base password.

I know it's not the most secure method in the world but I think it is a good compromise between remembering the passwords and providing a unique-per-site decent strength 9 character password. If someone figured out my scheme they could get into all my accounts but in order to figure out my scheme they would have to brute force crack two of my 9 character passwords from hashes from two different sites and then match up the two accounts and compare the differences, that is the risk I currently take.

Re: Change your Last.fm password

#109

Post by adambyrtek » Thu, Jun 07, 2012, 10:52 PM UTC

News of this kind make me even more glad that I use random generated passwords for every site, with LastPass to manage all of that. (Waiting for a snarky comment about LastPass being supposedly hacked some time ago.)

Re: Change your Last.fm password

#110

Post by tzs » Thu, Jun 07, 2012, 10:55 PM UTC

anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

> I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops.

MythBusters looked at fingerprint scanners in episode 59, "Crimes and Myth-Demeanors 2". They were able to easily bypass both the cheap consumer models and an expensive professional one with advanced features that supposedly check for body heat and a pulse to make sure you aren't using a fake finger.

Another problem with biometrics: it allows unapproved sharing of identity information. If I use a fingerprint or iris scan or some such to identify myself to entity X and to entity Y, then even if I'm using different names with X and Y, they could compare biometric data and correlate my identities.