Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

ieeelog.com

Post reply on HN
Print view View original

51–60 of 138 posts

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#51

Post by e2e8 »

ghshephard wrote: post #48
0003 wrote: post #43

Earlier quoted context omitted.

I am not too well-versed in this sphere, but I would also require salting passwords when hashing. It obviously won't help if your database is compromised, but will protect your users (and your database) against the effects of leaks such as these.

One of these days we will shut down the "Salting password hashes is a useful thing to do." meme from 1994. See: http://codahale.com/how-to-safely-store-a-password/ for details.

Of course a salt will not make a single password harder to attack. A salt will however force you to attack passwords "one at a time" by making precomputed hashes useless.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#52

Post by kree10 »

fmavituna wrote: post #40
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

d) To not keep 100K users' passwords in a public FTP server :)

I'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#53

Post by jimhefferon »

kree10 wrote: post #52
fmavituna wrote: post #40

Earlier quoted context omitted.

d) To not keep 100K users' passwords in a public FTP server :)

I'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?

How do you dir on http?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#54

Post by DanBC »

diminoten wrote: post #21

Anyone have the file?

I'd be interested in it too.

But the Robert Morris worm wreaked devastation with a 350 word dictionary (and some mangling). And it don't think passwords have changed that much since the late 80s.

(http://www.ieee-security.org/TC/SP2012/papers/4681a538.pdf)

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#55

Post by pbhjpbhj »

masklinn wrote: post #10
PythonDeveloper wrote: post #2

How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?

> know how to md5 passwords MD5 is an utterly terrible password hash. It's just about as bad as plaintext. If you're hashing passwords with md5, please fix it and use one of scrypt, bcrypt or PBKDF2 (recommendations are generally in that order) with an acceptable load factor[0]. Go look up mozilla's coding security guide to know how to migrate from a terrible and insecure hash to a secure password hash. [0] the usual…

>It's just about as bad as plaintext. //

Hyperbole is just about as bad as murder.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#56

Post by astrodust »

jimhefferon wrote: post #53
kree10 wrote: post #52

Earlier quoted context omitted.

I'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?

How do you dir on http?

If this is your problem, FTP is not your answer.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#57

Post by emidln »

freehunter wrote: post #35
typicalrunt wrote: post #14

What concerns me is that I have to renew my IEEE membership very soon, and if they have the wrong logging enabled how can I be assured that they aren't logging me CC details? I've seen it happen in one of my client's production systems, but at least they never put the log files up on a public FTP site. I checked the ieee.org website and nothing about this has been mentioned yet. Not even a "We're investigating the al…

If they're taking credit card information, they have to be PCI compliant. An auditor should notice pretty quickly if they're logging CC transactions. Not to say it can't happen and you're absolutely right to be suspicious, but if they are there will be repercussions.

If they don't do the processing themselves, they can fill out the self questionaire, which basically amounts to "pay the damn application fee already".

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#58

Post by emidln »

pbhjpbhj wrote: post #55
masklinn wrote: post #10

Earlier quoted context omitted.

> know how to md5 passwords MD5 is an utterly terrible password hash. It's just about as bad as plaintext. If you're hashing passwords with md5, please fix it and use one of scrypt, bcrypt or PBKDF2 (recommendations are generally in that order) with an acceptable load factor[0]. Go look up mozilla's coding security guide to know how to migrate from a terrible and insecure hash to a secure password hash. [0] the usual…

> It's just about as bad as plaintext. // Hyperbole is just about as bad as murder.

md5 passwords lists are plaintext for modern hardware. Well, not exactly plaintext, since you might end up needing to search a couple collisions that also work, but in terms of repurposing the information to attack another system, it's extremely close to plaintext.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#59

Post by emidln »

hnriot wrote: post #41
ithcy2 wrote: post #32

Earlier quoted context omitted.

You'd better be prepared to fire half the corporate world. And then do it again the next month. Because people will never stop doing this.

any decent corporate IT dept make sure you don't by forcing often password changes and having quite secure rules for length and charactes in a password. My corporate IT force quarterly password changes for VPN, NIS and SSO, which all must be different, all must be 8+ characters, all must have mix of upper and lower and numerics. They also store the hash of all previous passwords to prevent users from recycling. So I…

These are all general password policy "best practices", and typically result in users using something along the lines of

FuC|Kj0017GUy-1 FuC|Kj0017GUy-2 FuC|Kj0017GUy-3

Or, for users who are lazier (read: most of them), you get:

S3P-2k12 0c7-2k12 n0V-2k12

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#60

Post by mercuryrising »

shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

Can you send MD5 encrypted passwords over HTTP? Can you send passwords over websockets?
Post reply on HN