Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evernote hacked

blog.evernote.com

Post reply on HN
Print view View original

51–60 of 220 posts

Re: Evernote hacked

#51

Post by kordless »

kmfrk wrote: post #43
devicenull wrote: post #39

Earlier quoted context omitted.

Your average user has no idea what a hash nor a salt is. There's really no reason for them to include their hashing algorithm in an email like that.

Technology-savvy users want to be informed and assured as well. Why would they not include it? Situations like these specifically call for not leaving things up to the users' imagination. The recent Facebook incident (well, one of them) created a big scare. Better to control the narrative, before others decide to tell their version of the story.

Where 'their version' == some made up bullshit that sounds good.

Re: Evernote hacked

#52

Post by lawnchair_larry »

rdl wrote: post #18
Ensorceled wrote: post #9

I'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error. Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...

Seriously, who doesn't do 2fa for something like this in 2013? Or 2012, or even 2011?

Everyone?

Re: Evernote hacked

#53

Post by ishansharma »

LeeHunter wrote: post #28
Ensorceled wrote: post #9

I'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error. Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...

I have a lot of respect for the Evernote team. They've done a great job of improving the product over the last couple of years but it's puzzling that they've recently rolled out a version of Evernote targeted at business without addressing 2fa. It's a very serious gap in their offering.

And add poor performance of their app on iPad. They are present everywhere but except Windows client, all other apps feel very very slow!

Re: Evernote hacked

#54

Post by ocharles »

gameshot911 wrote: post #46
UnoriginalGuy wrote: post #29

Earlier quoted context omitted.

No, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reverse it literally doesn't exist in the output. The only way to "break" correctly working hashes is to encrypt tons of passwords (+salt) and see if the lossy output is identical to the output you got from the previously hashed password. Which is a very time cons…

If the output is lossy and doesn't contain all the info needed to reverse it, is it possible to guaranteeing that each each output is unique? Or could two different inputs theoretically create the same lossy output?

It depends on your hashing function. What you're talking about is a https://en.wikipedia.org/wiki/Collision_(computer_science)

Re: Evernote hacked

#55

Post by lawnchair_larry »

martinkallstrom wrote: post #45
UnoriginalGuy wrote: post #10

Earlier quoted context omitted.

Encryption on /what/? Point to point or content encryption? Also if your password has been compromised and that same password is used to encrypt your data then what exactly would encryption do?

Passwords are typically not used for encryption, since you don't want to re-encrypt data when user changes the password.

Yes they are, just in a more complicated way. You don't have to re-encrypt if the user changes their password. FDE would be pretty useless if so.

Re: Evernote hacked

#56

Post by jimktrains2 »

Ensorceled wrote: post #9

I'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error. Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...

What lack of encryption?

Re: Evernote hacked

#57

Post by [deleted] »

jgrahamc wrote: post #36
UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.( http://en.wikipedia.org/wiki/Salt_(cryptography) )) That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.

[deleted]

Re: Evernote hacked

#58

Post by jms703 »

UnoriginalGuy wrote: post #10
jms703 wrote: post #4

I don't understand why they don't offer encryption.

Encryption on /what/? Point to point or content encryption? Also if your password has been compromised and that same password is used to encrypt your data then what exactly would encryption do?

Encryption on the notes. Who would ever promote using the evernote login to encrypt?!

Re: Evernote hacked

#59

Post by UnoriginalGuy »

gameshot911 wrote: post #46
UnoriginalGuy wrote: post #29

Earlier quoted context omitted.

No, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reverse it literally doesn't exist in the output. The only way to "break" correctly working hashes is to encrypt tons of passwords (+salt) and see if the lossy output is identical to the output you got from the previously hashed password. Which is a very time cons…

If the output is lossy and doesn't contain all the info needed to reverse it, is it possible to guaranteeing that each each output is unique? Or could two different inputs theoretically create the same lossy output?

Each output is NOT unique. Since it can take in an almost unlimited amount of data and output a set length string we know for a fact collisions will eventually occur.

The question is - can we predict these collisions or guestimate when they might occur without having to actually try every combination? If the answer is "yes" then the hashing algorithm is broken (see MD5).

Re: Evernote hacked

#60

Post by NoPiece »

jgrahamc wrote: post #36
UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.( http://en.wikipedia.org/wiki/Salt_(cryptography) )) That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.

Curious, if the attacker knows what the encryption algorithm is, does it help them at all in breaking it? I.e., does it potentially delay breaking it by not revealing it?
Post reply on HN