Anyone have the file?
Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
21–30 of 138 posts
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#22I think it's time for web browsers to step up and start showing a visual indication for websites that store passwords in plaintext.
How would a browser ever know this?
Probably the same way they know which sites are likely to contain malware or be involved in phishing scams: user reports.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#23Earlier quoted context omitted.
You seem unfamiliar with the specific case. It wasn't the user database that was compromised. It was plainly obvious to any user of IEEE that they were storing your password in clear text. Because they would, y'know, mail it to you . And the mail would have live hyperlinks to access your account, which generally means GET requests.
> You seem unfamiliar with the specific case. It wasn't the user database that was compromised. Which isn't really relevant. A password leak is a password leak, whatever its source is. > It was plainly obvious to any user of IEEE that they were storing your password in clear text And nobody every took issue with that? > And the mail would have live hyperlinks to access your account, which generally means GET requests…
Which isn't really relevant.
Then please don't bring it up, i.e., say things like "if the user database is compromised, you can safely assume all of the site is".
And nobody every took issue with that?
Maybe they did, maybe they didn't. IEEE members are probably slightly more informed than your random AOL user. There are plenty of mail managers out there that mail you your password automatically every month.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#24Earlier quoted context omitted.
Because it's not that important. In most cases what someone could do with my account is to view articles I have paid for, either piecemeal or as a subscription. It's much more in their interest than my interest to keep that private. They've sent me my cleartext password several times before I finally wrote it down in a place I could keep it safe, and I was always thankful. Also, the default password is something very…
You realize that people use the same password on multiple sites? given that people signed up using corporate email addresses, this could be used to hack internal networks of companies.
Using a corporate password for any other site is a firable misconduct.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#25What concerns me is that I have to renew my IEEE membership very soon, and if they have the wrong logging enabled how can I be assured that they aren't logging me CC details? I've seen it happen in one of my client's production systems, but at least they never put the log files up on a public FTP site. I checked the ieee.org website and nothing about this has been mentioned yet. Not even a "We're investigating the al…
In general, you may expect that even if GETs are fully logged, POSTs are not. You can check this on your own when you renew.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#26Sorry, but the entire purpose of the ieeelog site is to document this breach? Fine...I guess? It just kind of threw me off...I thought it was somehow connected to IEEE-proper, as if it were the dev blog for IEEE.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#27Earlier quoted context omitted.
How would a browser ever know this?
Probably the same way they know which sites are likely to contain malware or be involved in phishing scams: user reports.
Yep. http://news.ycombinator.com/item?id=4555083
I.E. is actually the best at stopping social engineering attacks on your average consumer because of their SmartScreen technology, which relies completely on feedback from the community, both automatic and manual. No reason to downvote this or the original comment IMO.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#28Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#29I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum.
Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsibility to:
a) Not send passwords over http b) Not send passwords via GET (which is typically logged) c) Hash their passwords
Anything less, and you're putting the public in danger.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#30"For a few days I was uncertain what to do with the information and the data."
what? how is telling the ieee not completely the right thing to do, as soon as possible?
(this is the source - http://www.dragusin.ro/; seems like an academic rather than a hacker. still, that seems like an odd thing to be uncertain about).