Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evernote hacked

blog.evernote.com

Post reply on HN
Print view View original

41–50 of 220 posts

Re: Evernote hacked

#41

Post by UnoriginalGuy »

[deleted] wrote: post #22
kmfrk wrote: post #19

Earlier quoted context omitted.

"One-way encryption" is a peculiar choice of phrase.

[deleted]

An oxymoron is two words which mean the opposite but yet the two combined words form a new expression which remains "true."

For example "bitter sweet." Bitter and sweet mean two different opposite things, but the two words together are "true" because something can be both bitter and sweet.

Encryption means simply to convert information into a form which cannot be easily read by an unauthorised party. One way or lossy encryption is not a contradiction of that.

Re: Evernote hacked

#42

Post by nilsbunger »

rdl wrote: post #18
Ensorceled wrote: post #9

I'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error. Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...

Seriously, who doesn't do 2fa for something like this in 2013? Or 2012, or even 2011?

Rackspace doesn't support 2fa in 2013. Or multiple users on an account, for that matter... (much to my shock and dismay)

Re: Evernote hacked

#43

Post by kmfrk »

devicenull wrote: post #39
jgrahamc wrote: post #36

Earlier quoted context omitted.

Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.( http://en.wikipedia.org/wiki/Salt_(cryptography) )) That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.

Your average user has no idea what a hash nor a salt is. There's really no reason for them to include their hashing algorithm in an email like that.

Technology-savvy users want to be informed and assured as well. Why would they not include it?

Situations like these specifically call for not leaving things up to the users' imagination.

The recent Facebook incident (well, one of them) created a big scare. Better to control the narrative, before others decide to tell their version of the story.

Re: Evernote hacked

#44

Post by UnoriginalGuy »

apawloski wrote: post #33
UnoriginalGuy wrote: post #29

Earlier quoted context omitted.

No, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reverse it literally doesn't exist in the output. The only way to "break" correctly working hashes is to encrypt tons of passwords (+salt) and see if the lossy output is identical to the output you got from the previously hashed password. Which is a very time cons…

People are going to argue with you semantically, but you'll all generally be in agreement (except 3DES is a block cipher, not a hash function).

3DES is a black cipher but block ciphers can be used for hashing. 3DES in particular was used on UNIX/Linux based systems quite extensively.

http://www.freebsd.org/doc/handbook/crypt.html

See this: http://en.wikipedia.org/wiki/One-way_compression_function#Co...

Re: Evernote hacked

#45

Post by martinkallstrom »

UnoriginalGuy wrote: post #10
jms703 wrote: post #4

I don't understand why they don't offer encryption.

Encryption on /what/? Point to point or content encryption? Also if your password has been compromised and that same password is used to encrypt your data then what exactly would encryption do?

Passwords are typically not used for encryption, since you don't want to re-encrypt data when user changes the password.

Re: Evernote hacked

#46

Post by gameshot911 »

UnoriginalGuy wrote: post #29
kmfrk wrote: post #19

Earlier quoted context omitted.

"One-way encryption" is a peculiar choice of phrase.

No, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reverse it literally doesn't exist in the output. The only way to "break" correctly working hashes is to encrypt tons of passwords (+salt) and see if the lossy output is identical to the output you got from the previously hashed password. Which is a very time cons…

If the output is lossy and doesn't contain all the info needed to reverse it, is it possible to guaranteeing that each each output is unique? Or could two different inputs theoretically create the same lossy output?

Re: Evernote hacked

#47

Post by kmfrk »

rdl wrote: post #30
kmfrk wrote: post #23

Earlier quoted context omitted.

Apple, Microsoft, Yahoo (at least non-US), etc. ... I'm not sure if there are any bookmark services that actually support this, though it'd be a decent selling point. It was a big deal, when Google finally assed themselves to implement it for Gmail, but companies have been embarrassingly slow in following their example. Especially when they provide e-mail services. Twitter hired TFA specialists a few months back, but…

Google Chrome does bookmark sync using user-provided passphrase, so I'd consider that bookmark service with client side crypto and 2fa. Crappy consumer services not supporting 2fa is somewhat understandable. No one uses Apple or Yahoo web services for business. People do seem to use Evernote in business contexts. Google Apps for your Domain is a fairly legitimate business option, as is Google Docs.

Right, forgot Chrome. I only thought of Opera, when it comes to browser-backed bookmark sync - at least on paper, since it doesn't work at all for me.

Re: Evernote hacked

#48

Post by josephscott »

jgrahamc wrote: post #36
UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.( http://en.wikipedia.org/wiki/Salt_(cryptography) )) That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.

Agreed, it would be nice to know they are using something reasonable, like bcrypt.

Their description would satisfied by a simple MD5 + salt, which wouldn't be very good for password storage.

Re: Evernote hacked

#49

Post by ga0bi »

I filed a ticket this morning after I was unable to login to the Mac client. Here's their response:

"Dear Valued Customer,

We're truly sorry for the inconvenience this has caused you this morning. We are attempting to contact our entire userbase about this matter, but we feel that immediate action in these cases is the most prudent course."

The rest of the email contained the contents of their blog post.

Re: Evernote hacked

#50

Post by ilconsigliere »

tomjen3 wrote: post #37
UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

I haven't received such an email, wonder why. Anyway Evernotes android client wasn't very good and it was far too slow to start. And now the have been hacked. Anybody know a good alternative?

catch.com incredibly simple + fast + easy to capture. no notebooks though only "spaces"
Post reply on HN