Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

League of Legends database compromised, passwords hashed without salt

euw.leagueoflegends.com

Post reply on HN
Print view View original

31–40 of 109 posts

Re: League of Legends database compromised, passwords hashed without salt

#31

Post by dbecker »

chc wrote: post #17
tantalor wrote: post #6

Earlier quoted context omitted.

http://en.wikipedia.org/wiki/Federated_identity

Federated identity doesn't replace passwords, it just punts the whole process of authentication to a third party. That third party will still need to authenticate the user somehow, which brings us right back where we started.

But it allows the passwords to be stored by someone who specializes in security.

It'd be nice if everyone who runs a non-trivial website stayed was a security expert, but we're also busy with other aspects of the site.

Re: League of Legends database compromised, passwords hashed without salt

#32

Post by mrb »

SoftwareMaven wrote: post #23

I'm nearly positive the US code salted the hashes (it's been a long time since I was in that code :). I say US code because (again, memory is dim) I think they had a partnership with a company in the EU and that (might have) included authentication. The platform guys at Riot were the sharpest group of engineers I've worked with. Smart and able to get stuff done without bike shedding. They did stuff right.

It is possible to tell the passwords were unsalted because: "We compared encrypted password hashes and discovered that 11 passwords were shared by over 10,000 players each" and one of the points of salting is to make impossible to identify identical passwords from the hashes.

Re: League of Legends database compromised, passwords hashed without salt

#34

Post by [deleted] »

mrb wrote: post #32
SoftwareMaven wrote: post #23

I'm nearly positive the US code salted the hashes (it's been a long time since I was in that code :). I say US code because (again, memory is dim) I think they had a partnership with a company in the EU and that (might have) included authentication. The platform guys at Riot were the sharpest group of engineers I've worked with. Smart and able to get stuff done without bike shedding. They did stuff right.

It is possible to tell the passwords were unsalted because: "We compared encrypted password hashes and discovered that 11 passwords were shared by over 10,000 players each" and one of the points of salting is to make impossible to identify identical passwords from the hashes.

[deleted]

Re: League of Legends database compromised, passwords hashed without salt

#35

Post by duaneb »

confluence wrote: post #22

Is it just me or have the number of announcements on HN about password leaks gone up in the last few weeks? I think availability bias is kicking in, with each additional announcement, more links about announcements are posted (for karma) or more sites feel like they can announce, under the cover of larger leaks, that they themselves have been compromised. Probably just me. [1] - http://en.wikipedia.org/wiki/Availabil…

I'm OK with that. Hash leaks are big news.

Re: League of Legends database compromised, passwords hashed without salt

#36

Post by Zash »

astrodust wrote: post #16
nnnnnnnn wrote: post #15

Earlier quoted context omitted.

Yes. A great, practical and scalable example is found in ssh: http://en.wikipedia.org/wiki/Secure_Shell#Key_management I'll try to explain how it works in non-technical terms (so please don't nitpick as I'm glossing over details) User generates a public and private keypair. The public key is given to the remote site (such as LoL or Linkedin), but the public key is not secret -- it is public. You can post it on your b…

I would love to see an ssh-like key exchange built into browsers. You add your key to the site, GitHub style, and then you use that for auth. No more nonsense with OAuth or "remember my password" or the remote site having your password just because they grabbed the DB. It's just a useless public key to them.

SSL Client certificate authentication has existed in browsers for a long time. Browsers even have built in key generation, but noone uses it. Probably because the UI is not very good.

Mozillas new BrowserID scheme is pretty similar to this too.

Re: League of Legends database compromised, passwords hashed without salt

#37

Post by sirn »

astrodust wrote: post #16
nnnnnnnn wrote: post #15

Earlier quoted context omitted.

Yes. A great, practical and scalable example is found in ssh: http://en.wikipedia.org/wiki/Secure_Shell#Key_management I'll try to explain how it works in non-technical terms (so please don't nitpick as I'm glossing over details) User generates a public and private keypair. The public key is given to the remote site (such as LoL or Linkedin), but the public key is not secret -- it is public. You can post it on your b…

I would love to see an ssh-like key exchange built into browsers. You add your key to the site, GitHub style, and then you use that for auth. No more nonsense with OAuth or "remember my password" or the remote site having your password just because they grabbed the DB. It's just a useless public key to them.

TLS Client Authentication[1]? I believe this is what StartSSL[2] is using for user to access their control panel.

The biggest problem is it is so user unfriendly.

[1]: http://www.browserauth.net/tls-client-authentication

[2]: http://www.startssl.com/

Re: League of Legends database compromised, passwords hashed without salt

#38

Post by jsprinkles »

confluence wrote: post #22

Is it just me or have the number of announcements on HN about password leaks gone up in the last few weeks? I think availability bias is kicking in, with each additional announcement, more links about announcements are posted (for karma) or more sites feel like they can announce, under the cover of larger leaks, that they themselves have been compromised. Probably just me. [1] - http://en.wikipedia.org/wiki/Availabil…

Not just the last few weeks, the last few days. I was already drawing that conclusion before this disclosure, and internally speculating that the same group or person might be responsible.

Re: League of Legends database compromised, passwords hashed without salt

#39

Post by arkem »

mrb wrote: post #32
SoftwareMaven wrote: post #23

I'm nearly positive the US code salted the hashes (it's been a long time since I was in that code :). I say US code because (again, memory is dim) I think they had a partnership with a company in the EU and that (might have) included authentication. The platform guys at Riot were the sharpest group of engineers I've worked with. Smart and able to get stuff done without bike shedding. They did stuff right.

It is possible to tell the passwords were unsalted because: "We compared encrypted password hashes and discovered that 11 passwords were shared by over 10,000 players each" and one of the points of salting is to make impossible to identify identical passwords from the hashes.

Parent is talking about the League of Legends North American region which does not necessarily share its authentication code base with the European regions which were the ones compromised.

Re: League of Legends database compromised, passwords hashed without salt

#40

Post by nnnnnnnn »

Zash wrote: post #36
astrodust wrote: post #16

Earlier quoted context omitted.

I would love to see an ssh-like key exchange built into browsers. You add your key to the site, GitHub style, and then you use that for auth. No more nonsense with OAuth or "remember my password" or the remote site having your password just because they grabbed the DB. It's just a useless public key to them.

SSL Client certificate authentication has existed in browsers for a long time. Browsers even have built in key generation, but noone uses it. Probably because the UI is not very good. Mozillas new BrowserID scheme is pretty similar to this too.

PKI as implemented by SSL Certs is needlessly complicated, which is a big part of why no one has adopted it for end user authentication. Compare what I described above to the mess described here: http://en.wikipedia.org/wiki/Public-key_infrastructure

A decentralized key system as ssh provides is much more appropriate for end users.

Post reply on HN