Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

ieeelog.com

Post reply on HN
Print view View original

41–50 of 138 posts

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#41

Post by hnriot »

ithcy2 wrote: post #32
Evbn wrote: post #24

Earlier quoted context omitted.

Using a corporate password for any other site is a firable misconduct.

You'd better be prepared to fire half the corporate world. And then do it again the next month. Because people will never stop doing this.

any decent corporate IT dept make sure you don't by forcing often password changes and having quite secure rules for length and charactes in a password. My corporate IT force quarterly password changes for VPN, NIS and SSO, which all must be different, all must be 8+ characters, all must have mix of upper and lower and numerics. They also store the hash of all previous passwords to prevent users from recycling.

So I think the onus of responsibility lies with corp IT and not HR.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#42

Post by barik »

danielweber wrote: post #9
PythonDeveloper wrote: post #2

How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?

Because it's not that important. In most cases what someone could do with my account is to view articles I have paid for, either piecemeal or as a subscription. It's much more in their interest than my interest to keep that private. They've sent me my cleartext password several times before I finally wrote it down in a place I could keep it safe, and I was always thankful. Also, the default password is something very…

Sure, you can do all of these things, and being able to view IEEE papers is not exactly the worst of problems. Now please let me know if I'm incorrect (and I hope I am), but it appears that in addition to viewing research papers your IEEE Web Account also lets you modify your @ieee.org e-mail alias account (if they have set one up; if not, they can create one) [1].

If so, it should be quite interesting if someone uses the IEEE Web Account username/password to re-forward your @ieee.org e-mail somewhere else. I can see all sorts of nefarious activities that can result from this, such as clicking on various "I forgot my password" links that also use your @ieee account in order to get access to other, perhaps more important resources.

[1] http://eleccomm.ieee.org/

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#43

Post by 0003 »

shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

I am not too well-versed in this sphere, but I would also require salting passwords when hashing. It obviously won't help if your database is compromised, but will protect your users (and your database) against the effects of leaks such as these.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#44

Post by ZoFreX »

shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

Can we amend c) to mandate bcrypt, scrypt, or PBKDF2 with a sufficient work factor that is reviewed every 12 months?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#45

Post by joshuahedlund »

engtech wrote: post #12

I think it's time for web browsers to step up and start showing a visual indication for websites that store passwords in plaintext.

Browsers can't reliably know this. Although they could probably at least figure out if the form submission is going to be a freaking GET request!

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#46

Post by ZoFreX »

0003 wrote: post #43
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

I am not too well-versed in this sphere, but I would also require salting passwords when hashing. It obviously won't help if your database is compromised, but will protect your users (and your database) against the effects of leaks such as these.

> It obviously won't help if your database is compromised

Good news, everyone: it will!

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#47

Post by tisme »

andrewcooke wrote: post #30

"For a few days I was uncertain what to do with the information and the data." what? how is telling the ieee not completely the right thing to do, as soon as possible? (this is the source - http://www.dragusin.ro/ ; seems like an academic rather than a hacker. still, that seems like an odd thing to be uncertain about).

This may have been on his mind:

http://www.iovation.com/blog/dutch-hacker-extradited-from-ro...

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#48

Post by ghshephard »

0003 wrote: post #43
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

I am not too well-versed in this sphere, but I would also require salting passwords when hashing. It obviously won't help if your database is compromised, but will protect your users (and your database) against the effects of leaks such as these.

One of these days we will shut down the "Salting password hashes is a useful thing to do." meme from 1994.

See: http://codahale.com/how-to-safely-store-a-password/ for details.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#49

Post by harryh »

hnriot wrote: post #41
ithcy2 wrote: post #32

Earlier quoted context omitted.

You'd better be prepared to fire half the corporate world. And then do it again the next month. Because people will never stop doing this.

any decent corporate IT dept make sure you don't by forcing often password changes and having quite secure rules for length and charactes in a password. My corporate IT force quarterly password changes for VPN, NIS and SSO, which all must be different, all must be 8+ characters, all must have mix of upper and lower and numerics. They also store the hash of all previous passwords to prevent users from recycling. So I…

You know how people that work at your company remember their passwords after having to change them so often and comply with so many rules? They write them down on post it notes that they leave at their desks.

Nice work!

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#50

Post by Tipzntrix »

masklinn wrote: post #33
engtech wrote: post #28

Earlier quoted context omitted.

web browsers are doing this for malware / fraud sites. see other comments on parent for citations.

That's reactive, for passwords in cleartext it's not very useful: by the time you get the news, the damage has been done already. At best it tells you to change you passwords before the site itself tells you.

That's a fair point. The only way it would work is if an anonymous insider reported the company before the general public knew about it. Either that or it would serve as a blacklist for companies who already made one mistake, though it's very unlikely to see them make 2 (and in Sony's case, people are still using PlayStation Network anyway).
Post reply on HN