Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evernote hacked

blog.evernote.com

Post reply on HN
Print view View original

121–130 of 220 posts

Re: Evernote hacked

#121

Post by Tichy »

UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

"Please create a new password by signing into your account on evernote.com"

I dunno, isn't logging into a site that has just been hacked exactly the thing I don't want to do?

For that matter, linking to a hacking announcement on a hacked site seems like a bad idea, too.

Re: Evernote hacked

#122

Post by Niten »

Terretta wrote: post #109
UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words.

The example passphrase does have the equivalent of 44 bits of entropy:

log_2 (2048^4) = 4 * 11 = 44

However, if we take a random password formed by just seven of the 95 printable ASCII characters, we already have a password four times stronger than such a passphrase:

log_2 (95^7) ≈ 45.99

XKCD is great and all, but I wish Randall had been more clear that this comparison does not touch on the strength of a random password, because I have since seen an infuriating number of people point to it to claim that passphrases are more secure than random passwords. They are not.

Re: Evernote hacked

#123

Post by cschneid »

raverbashing wrote: post #115
aadamov wrote: post #88

Earlier quoted context omitted.

But this is why we do one or both things: strip obvious things from hashed password and store them separately or add a trivial character reshuffling algorithm. The point is that hacker would not only have to steal your hashed passwords, but also steal and understand your code. Makes it more complicated.

No The security of your system can never depend on an attacker not knowing the implementation. Or: Security through obscurity (is no security) Using gimmicks like for example shuffling some characters in the hash may delay some attacks. But the problem is that these techniques are usually done on systems that have no sufficient security. Have a big salt and use PBKDF2 or Bcrypt and you know the exact difficulty of ge…

IMO, you should be doing both. People should use strong bcrypted passwords, with a salt, then ALSO a 'secret' pepper value (long value stored in app code). This adds additional security in the case of a db-only dump being released, and doesn't harm the strength or a full code+db release at all either.

Stripping off identifying info from hashes like talked about in this thread doesn't weaken the hash in any way, but instead makes it another thing to figure out by an attacker. At worse, you slow them down a bit, allowing you to do things like mass-email everybody affected.

Security is about depth, not putting 100% of your trust in a single algorithm. Even if that algorithm is well trusted. It's simply not an either/or.

Re: Evernote hacked

#124

Post by fiatpandas »

Terretta wrote: post #109
UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

>Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation demand.

I just don't understand the logic behind some of these password rules. Wouldn't it require more effort to explicitly disallow certain characters? Like, they wrote code somewhere that is specifically making sure your password doesn't have a spaces, and other arbitrarily chosen characters.

It doesn't make sense to restrict anything in passwords other than length (and of course testing that is meets certain complexity/length requirements-- smartly). Just set your DB field to be 30 characters, accept any character, and be done with it.

There must be some logical explanation behind why companies implement these rules. And banks are the worst. Because people far more experienced than me at programming (e.g. Evernote devs) make these decisions, so there must be some reason. Is the decision a defense against SQL injection techniques? Since injections usually contain spaces. But then again, this is 2013 so you think they would use prepared statements, or something.

Madness!

Re: Evernote hacked

#125

Post by anonymfus »

NoPiece wrote: post #60
jgrahamc wrote: post #36

Earlier quoted context omitted.

Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.( http://en.wikipedia.org/wiki/Salt_(cryptography) )) That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.

Curious, if the attacker knows what the encryption algorithm is, does it help them at all in breaking it? I.e., does it potentially delay breaking it by not revealing it?

For public service like Evernote attacker can usually create own accounts with known passwords before stealing database and then try to found algorithm and salt by brute force hashes against known password.

Re: Evernote hacked

#126

Post by mhartl »

makeramen wrote: post #79

I managed to reset my password to the same that it was before. I changed it again right away of course, but there should definitely be some protection against that. (FWIW I didn't get the email so I was simply locked out and used their "forget password" form instead of trying to log in, which may have a different reset process).

This morning I tried to use the same password and it wouldn't let me, so maybe they fixed this issue.

Re: Evernote hacked

#127

Post by sdevlin »

fiatpandas wrote: post #124
Terretta wrote: post #109

Earlier quoted context omitted.

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

>Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation demand. I just don't understand the logic behind some of these password rules. Wouldn't it require more effort to explicitly disallow certain characters? Like, they wrote code somewhere that is specifically making…

Since you're only going to store the hashed value, there's no practical reason to limit the maximum length of the password.

Re: Evernote hacked

#128

Post by nawitus »

raverbashing wrote: post #115
aadamov wrote: post #88

Earlier quoted context omitted.

But this is why we do one or both things: strip obvious things from hashed password and store them separately or add a trivial character reshuffling algorithm. The point is that hacker would not only have to steal your hashed passwords, but also steal and understand your code. Makes it more complicated.

No The security of your system can never depend on an attacker not knowing the implementation. Or: Security through obscurity (is no security) Using gimmicks like for example shuffling some characters in the hash may delay some attacks. But the problem is that these techniques are usually done on systems that have no sufficient security. Have a big salt and use PBKDF2 or Bcrypt and you know the exact difficulty of ge…

Using a big salt is essentially the same as using a secret character shuffling algorithm. The difference is that the salt value is thought to be on the 'data side' and not in the code side, so it's allowed to be secret. The distinction is pretty arbitrary, though.

Re: Evernote hacked

#129

Post by apawloski »

Terretta wrote: post #109
UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

I don't think UnoriginalGuy actually works for dropbox -- that first line is on the actual blog post too.

Re: Evernote hacked

#130

Post by jimktrains2 »

whitenoise wrote: post #97
jimktrains2 wrote: post #66

Earlier quoted context omitted.

You can encrypt notes.

How do you encrypt a complete note? AFAIK the official Evernote client only allows encrypting text content within a note.

Yes, as far as I know that's all you can do. I wish you could do pictures as well:-\
Post reply on HN