Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password leaks bigger than first thought

h-online.com

Post reply on HN
Print view View original

11–20 of 55 posts

Re: Password leaks bigger than first thought

#11

Post by 3mpach3r »

16s wrote: post #10
waterlesscloud wrote: post #5

Earlier quoted context omitted.

I would be very surprised if this sort of problem is not quite widespread among companies with giant userbases. We'll see more of these, and bigger ones.

Microsoft Active Directory servers store passwords as plain MD4 hashes. http://16s.us/ms_ad_hashes/ These servers are used by governments and large organizations all over the world.

I would like to assume that the REALLY big companies like Google, Microsoft, Apple, Amazon, etc. can figure out how to effectively store passwords. While I acknowlege that Active directory is a bit different from a web service, if this can't be realized, god knows what's happening with the other 500 sites we all have accounts on (that invariably use shared passwords: http://xkcd.com/792/ ). I really love it when I get password reset emails with my original password in plain text.

Re: Password leaks bigger than first thought

#12

Post by 16s »

3mpach3r wrote: post #11
16s wrote: post #10

Earlier quoted context omitted.

Microsoft Active Directory servers store passwords as plain MD4 hashes. http://16s.us/ms_ad_hashes/ These servers are used by governments and large organizations all over the world.

I would like to assume that the REALLY big companies like Google, Microsoft, Apple, Amazon, etc. can figure out how to effectively store passwords. While I acknowlege that Active directory is a bit different from a web service, if this can't be realized, god knows what's happening with the other 500 sites we all have accounts on (that invariably use shared passwords: http://xkcd.com/792/ ). I really love it when I ge…

Exchange email systems have web interfaces. They typically authenticate with AD.

Re: Password leaks bigger than first thought

#13

Post by pixelcort »

lucian1900 wrote: post #4
TrevorJ wrote: post #2

Does the number of passwords in the hashed list matter in terms of how easy or hard they will be to crack? Does this have implications for a rainbow table-type attack?

I guess the more you have, the more information you have about the salt used. I'm not sure it'd be useful though. And many of these hashes aren't salted anyway.

The real question is, if a site used a salt, was it a per-user salt or a global salt?

Re: Password leaks bigger than first thought

#14

Post by ams6110 »

Last month Last.fm admitted to having received several reports of spamming involving user data.

Over the last 6--9 months I have definitely noticed an uptick in the random "connection" requests I get on LinkedIn. I don't know if this is because their userbase has grown and more people are just shotgunning connection requests, or if these represent first steps at an attempted social engineering attack via hacked accounts on which I appear in the "people you might know."

So far none of these have been from people I actually know even remotely, so I'm guessing it's just simple spam (and I report it as such).

Re: Password leaks bigger than first thought

#15

Post by lomegor »

DanielRibeiro wrote: post #8
lomegor wrote: post #3

I find it really incredible that this companies were so careless. Really. I know that security practices are rare to come by, but come on! LinkedIn, eHarmony and last.fm! These are some of the biggest websites.

I'd argue that security practices are not that hard to come by: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

I meant that are hard to see implemented on websites, not hard to find. Sorry

Re: Password leaks bigger than first thought

#16

Post by zizee »

What do people think about outsourcing your authentication to someone else?

Full Disclosure: I'm currently working on a brandable authentication host (http://www.authic.com) that will outsource the pain of storing your password hashes securly and provide your web app with slick a user account UX.

Re: Password leaks bigger than first thought

#17

Post by Jabbles »

waffle_ss wrote: post #7

Unsurprising that >95% of the password hashes have been broken. I remember being annoyed when I signed up for LinkedIn (just checked my tweet history - it was 2010/06/10) because they were only allowing 16 characters in the password field. EDIT: Whoops, guess I should have done some napkin math before claiming that there are rainbow tables that cover that area. /me slaps wrist

26^16 ~ 4e22, so no such rainbow tables exist.

Re: Password leaks bigger than first thought

#18

Post by yuhong »

16s wrote: post #10
waterlesscloud wrote: post #5

Earlier quoted context omitted.

I would be very surprised if this sort of problem is not quite widespread among companies with giant userbases. We'll see more of these, and bigger ones.

Microsoft Active Directory servers store passwords as plain MD4 hashes. http://16s.us/ms_ad_hashes/ These servers are used by governments and large organizations all over the world.

Yea it dates back to the beginning of NT (which is why it is MD4) and by now this hash is used in so many Windows protocols it is hard to change.

Re: Password leaks bigger than first thought

#19

Post by rpearl »

waffle_ss wrote: post #7

Unsurprising that >95% of the password hashes have been broken. I remember being annoyed when I signed up for LinkedIn (just checked my tweet history - it was 2010/06/10) because they were only allowing 16 characters in the password field. EDIT: Whoops, guess I should have done some napkin math before claiming that there are rainbow tables that cover that area. /me slaps wrist

I mean... there are surely not rainbow tables that span all 62^16 16-character passwords consisting of alphanumerics only: that is 646,081,519 zettabytes of hashes (62^16 * 128 bits).

There are clearly rainbow tables which span a more useful dictionary of passwords, though--and certainly all the most common passwords.

Re: Password leaks bigger than first thought

#20

Post by [deleted] »

waffle_ss wrote: post #7

Unsurprising that >95% of the password hashes have been broken. I remember being annoyed when I signed up for LinkedIn (just checked my tweet history - it was 2010/06/10) because they were only allowing 16 characters in the password field. EDIT: Whoops, guess I should have done some napkin math before claiming that there are rainbow tables that cover that area. /me slaps wrist

[deleted]
Post reply on HN