Scribd hacked – emails and hashed passwords leaked
support.scribd.com
Scribd hacked – emails and hashed passwords leaked
1–10 of 72 posts
Re: Scribd hacked – emails and hashed passwords leaked
#2Every single time this happens, I immediately wonder: "what was the hashing scheme?"
Like many others before it, Scribd disappoints by not addressing this question. Instead we get this:
Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed).
How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with open sourced CUDA setups.
Further, how did they determine the following?
Most of our users were therefore unaffected by this; however, our analysis shows that a small percentage may have had their passwords compromised.
Re: Scribd hacked – emails and hashed passwords leaked
#3bad news, it's horrible.
I think different website should use different hash with salt to avoid this situation
Re: Scribd hacked – emails and hashed passwords leaked
#4This seems to have become a common occurrence. Just curious about a couple of things :
a) How easy/hard is it for the hashed passwords to be cracked by the hacker?
b) How are hackers getting access to emails and password data so often? You would think these large sites have enough layers of security to prevent this from happening. Is it social engineering or common loopholes in these systems?
Re: Scribd hacked – emails and hashed passwords leaked
#5Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…
We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm.
We do have database access logs, so it was pretty straightforward to identify which users were affected.
Re: Scribd hacked – emails and hashed passwords leaked
#6Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…
We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.
That's good to hear. As a future suggestion to anyone else who finds themselves in this unfortunate situation - including some technical granularity in your press release can go miles in offering reassurance to your technical audience/users.
Re: Scribd hacked – emails and hashed passwords leaked
#7Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…
We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.
Thanks for clarifying, good to see you're using a decent hashing algorithm :)
I'm still a little unsure of how you are able to know some users had their password compromised. Is it a simple case of finding successful log in attempts from the same IP address as attack?
Re: Scribd hacked – emails and hashed passwords leaked
#8Thankfully this doesn't read like the typical large corporation email: "...the attacker was able to gain access to all the passwords, which were stored as plaintext in the database." It sad to have to say it, but Kudos to Scribd for actually storing passwords the way they should be stored.
Re: Scribd hacked – emails and hashed passwords leaked
#9Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…
We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.
http://www.scribd.com/password/check thank you for this. now I can run a list of emails against this to see who has scribd account
Re: Scribd hacked – emails and hashed passwords leaked
#10Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…
We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.
So what do you do past this point? I know you can probably rough out how much time it would take to find hash collisions and ask as your users to change their passwords before that amount of time elapses, but past that point, can't you no longer assume that it's the actual user logging in to change their password?