Password leaks bigger than first thought
h-online.com
Password leaks bigger than first thought
1–10 of 55 posts
Re: Password leaks bigger than first thought
#2Does the number of passwords in the hashed list matter in terms of how easy or hard they will be to crack? Does this have implications for a rainbow table-type attack?
Re: Password leaks bigger than first thought
#3I find it really incredible that this companies were so careless. Really. I know that security practices are rare to come by, but come on! LinkedIn, eHarmony and last.fm! These are some of the biggest websites.
Re: Password leaks bigger than first thought
#4Does the number of passwords in the hashed list matter in terms of how easy or hard they will be to crack? Does this have implications for a rainbow table-type attack?
I guess the more you have, the more information you have about the salt used. I'm not sure it'd be useful though.
And many of these hashes aren't salted anyway.
Re: Password leaks bigger than first thought
#5I find it really incredible that this companies were so careless. Really. I know that security practices are rare to come by, but come on! LinkedIn, eHarmony and last.fm! These are some of the biggest websites.
I would be very surprised if this sort of problem is not quite widespread among companies with giant userbases.
We'll see more of these, and bigger ones.
Re: Password leaks bigger than first thought
#6"And one amusing detail – although eHarmony implores its users to use strong passwords including both upper and lower case letters, it saves the passwords in all upper case"
This is truly beautiful - made my day :)
Re: Password leaks bigger than first thought
#7Unsurprising that >95% of the password hashes have been broken. I remember being annoyed when I signed up for LinkedIn (just checked my tweet history - it was 2010/06/10) because they were only allowing 16 characters in the password field.
EDIT: Whoops, guess I should have done some napkin math before claiming that there are rainbow tables that cover that area. /me slaps wrist
Re: Password leaks bigger than first thought
#8I find it really incredible that this companies were so careless. Really. I know that security practices are rare to come by, but come on! LinkedIn, eHarmony and last.fm! These are some of the biggest websites.
I'd argue that security practices are not that hard to come by:
https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
Re: Password leaks bigger than first thought
#9"The API was developed 9 years ago, and appears not to have been updated since."
Last.fm could have updated this, except it would have meant making all their users do something.
Re: Password leaks bigger than first thought
#10I find it really incredible that this companies were so careless. Really. I know that security practices are rare to come by, but come on! LinkedIn, eHarmony and last.fm! These are some of the biggest websites.
I would be very surprised if this sort of problem is not quite widespread among companies with giant userbases. We'll see more of these, and bigger ones.
Microsoft Active Directory servers store passwords as plain MD4 hashes. http://16s.us/ms_ad_hashes/
These servers are used by governments and large organizations all over the world.