Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evernote hacked

blog.evernote.com

Post reply on HN
Print view View original

131–140 of 220 posts

Re: Evernote hacked

#131

Post by pyre »

Niten wrote: post #122
Terretta wrote: post #109

Earlier quoted context omitted.

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words. The example passphrase does have the equivalent of 44 bits of entropy: log_2 (2048^4) = 4 * 11 = 44 However, if we take a…

Passphrases are more secure than random passwords when you factor in the human element. A 64 character passphrase is more memorable than a 64 random character string and less likely to be written on a post-it note.

Re: Evernote hacked

#132

Post by pyre »

fiatpandas wrote: post #124
Terretta wrote: post #109

Earlier quoted context omitted.

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

>Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation demand. I just don't understand the logic behind some of these password rules. Wouldn't it require more effort to explicitly disallow certain characters? Like, they wrote code somewhere that is specifically making…

My understanding is that banks have these weird rules because of the legacy systems that they interface with. I've even heard of new systems built on top of old ones by writing an interface layer on top of the green-screen UI of the old system (i.e. automating the green-screen interaction / screen scraping).

Re: Evernote hacked

#133

Post by catharsis »

Niten wrote: post #122
Terretta wrote: post #109

Earlier quoted context omitted.

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words. The example passphrase does have the equivalent of 44 bits of entropy: log_2 (2048^4) = 4 * 11 = 44 However, if we take a…

This assumes that it is known that the password is four random words. The security of this method hinges on the fact that that information is not known.

Re: Evernote hacked

#134

Post by apawloski »

pyre wrote: post #131
Niten wrote: post #122

Earlier quoted context omitted.

Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words. The example passphrase does have the equivalent of 44 bits of entropy: log_2 (2048^4) = 4 * 11 = 44 However, if we take a…

Passphrases are more secure than random passwords when you factor in the human element. A 64 character passphrase is more memorable than a 64 random character string and less likely to be written on a post-it note.

Be careful -- you're starting to argue a slightly different point than what your parent made. You're not wrong, but you also haven't done anything to dismiss his claim. He's talking about a 7 character password vs a 4-word passphrase. Not equal sized, 64 character passwords.

Re: Evernote hacked

#135

Post by brown9-2 »

aadamov wrote: post #88
raverbashing wrote: post #69

Earlier quoted context omitted.

No, it's usually known by the format, or even stored together with the password Example: crypt stored the password in the format: $id$salt$encrypted

But this is why we do one or both things: strip obvious things from hashed password and store them separately or add a trivial character reshuffling algorithm. The point is that hacker would not only have to steal your hashed passwords, but also steal and understand your code. Makes it more complicated.

If someone can steal your passwords, doesn't it follow that they'd more than likely also have stolen your code?

Re: Evernote hacked

#136

Post by DocG »

Not cool. I use evernote for throwaway email passwords. And storing some usernames, without passwords. Just to remember usernames.

I wouldn't lose anything, it would be just inconvenient for me.

Re: Evernote hacked

#137

Post by miles »

catharsis wrote: post #133
Niten wrote: post #122

Earlier quoted context omitted.

Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words. The example passphrase does have the equivalent of 44 bits of entropy: log_2 (2048^4) = 4 * 11 = 44 However, if we take a…

This assumes that it is known that the password is four random words. The security of this method hinges on the fact that that information is not known.

Exactly. In a thread about "900gage!@#" being cracked in a few hours[1], this same discussion came up. It's worth reading for those who are wondering about passphrases vs. complex passwords.

[1] http://news.ycombinator.com/item?id=4545893

Re: Evernote hacked

#138

Post by bradleybuda »

UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

> "Never use the same password on multiple sites or services"

As long as we're stuck with passwords, this is the single best practice for protecting your accounts. Services WILL be compromised, again and again, and attackers have made a pattern of compromising a poorly-secured service as a side channel to get credentials for a more critical service.

Props to Evernote - it seems like they've done the right thing with password salting and hashing and hopefully this breach won't result in actual plaintext password reveals. But every week on HN we read about another shitty web app that is storing passwords in plaintext or with weak / unsalted hashes - when those services are breached, at least you'll know that the attackers don't have a credential they can use elsewhere.

Re: Evernote hacked

#140

Post by Joeri »

sdevlin wrote: post #105
Joeri wrote: post #94

Earlier quoted context omitted.

It doesn't really matter what they used, as hashing speeds improve so quickly. You have to assume that the password you were using on evernote will be cracked, so to be safe you have to change it everywhere you were using it. Given that most people reuse passwords i expect a lot of follow-on exploiting of other systems with the passwords retrieved from evernote.

If this were true, there would be no reason to hash passwords. There are hashing algorithms (bcrypt, scrypt, PBKDF2) that are specifically designed to be slow to prevent these attacks.

PBKDF2 is not memory hard, so even with known technology it can be broken relatively easy. Bcrypt seems secure for now, but you shouldn't rely on security through obscurity, which is essentially what putting faith in the irreversability of a hash is. The reality is that if a hashed password leaks, you should assume it will be broken. It's like with bank vaults. They're not designed to withstand attack, just to delay it. Well-hashed passwords delay attack, but they do not prevent it.
Post reply on HN