Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scribd hacked – emails and hashed passwords leaked

support.scribd.com

Post reply on HN
Print view View original

11–20 of 72 posts

Re: Scribd hacked – emails and hashed passwords leaked

#11

Post by kpumuk »

MattBearman wrote: post #7
kpumuk wrote: post #5

Earlier quoted context omitted.

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

Thanks for clarifying, good to see you're using a decent hashing algorithm :) I'm still a little unsure of how you are able to know some users had their password compromised. Is it a simple case of finding successful log in attempts from the same IP address as attack?

Compromised != Hacked. To clarify: no accounts were accessed by the hackers, but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users.

This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

Re: Scribd hacked – emails and hashed passwords leaked

#12

Post by ComputerGuru »

kpumunk and others, please note that http://www.scribd.com/password/check leaks information about whether or not a particular email address is in your system. It's hardly a critical weakness or anything, but just an FYI and something you may wish to reevaluate.

Edit: thanks for the quick fix! I would advise that a good compromise would be to change the current message from

"Good news - your password was not among those compromised. You do not need to take any action at this time."

to

"Good news - if this is the email your Scribd account is associated with, your password was not among those compromised. You do not need to take any action at this time."

Small difference, but the lack of definiteness to the response will be enough to make me think of double-checking my email (in my case, it was an email address I haven't used in years - I'm one of the first Scribd users!)

Re: Scribd hacked – emails and hashed passwords leaked

#13

Post by the_french »

the1 wrote: post #9
kpumuk wrote: post #5

Earlier quoted context omitted.

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

http://www.scribd.com/password/check thank you for this. now I can run a list of emails against this to see who has scribd account

They can modify it to simply say whether your account was compromised, regardless of whether you have an account (ie, if no account -> not compromised).

Re: Scribd hacked – emails and hashed passwords leaked

#14

Post by sveiss »

spizzo wrote: post #10
kpumuk wrote: post #5

Earlier quoted context omitted.

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

So what do you do past this point? I know you can probably rough out how much time it would take to find hash collisions and ask as your users to change their passwords before that amount of time elapses, but past that point, can't you no longer assume that it's the actual user logging in to change their password?

We performed a forced password reset on the users with compromised hashes. The old password will not work on Scribd, and those users will need to go through the password reset flow to regain access.

Re: Scribd hacked – emails and hashed passwords leaked

#15

Post by kpumuk »

spizzo wrote: post #10
kpumuk wrote: post #5

Earlier quoted context omitted.

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

So what do you do past this point? I know you can probably rough out how much time it would take to find hash collisions and ask as your users to change their passwords before that amount of time elapses, but past that point, can't you no longer assume that it's the actual user logging in to change their password?

We have reset passwords for all affected users. Hashes that got leaked are not useful now.

Re: Scribd hacked – emails and hashed passwords leaked

#16

Post by spizzo »

sveiss wrote: post #14
spizzo wrote: post #10

Earlier quoted context omitted.

So what do you do past this point? I know you can probably rough out how much time it would take to find hash collisions and ask as your users to change their passwords before that amount of time elapses, but past that point, can't you no longer assume that it's the actual user logging in to change their password?

We performed a forced password reset on the users with compromised hashes. The old password will not work on Scribd, and those users will need to go through the password reset flow to regain access.

Ah ok. I was wondering how you verified the users' identity if the password was compromised. That makes sense, thanks!

Re: Scribd hacked – emails and hashed passwords leaked

#17

Post by wuest »

the_french wrote: post #13
the1 wrote: post #9

Earlier quoted context omitted.

http://www.scribd.com/password/check thank you for this. now I can run a list of emails against this to see who has scribd account

They can modify it to simply say whether your account was compromised, regardless of whether you have an account (ie, if no account -> not compromised).

...Which they ought to do. Offering the ability to enumerate user accounts is unlikely to be the immediate goal of this utility, but it's an effect nonetheless.

Re: Scribd hacked – emails and hashed passwords leaked

#18

Post by kpumuk »

ComputerGuru wrote: post #12

kpumunk and others, please note that http://www.scribd.com/password/check leaks information about whether or not a particular email address is in your system. It's hardly a critical weakness or anything, but just an FYI and something you may wish to reevaluate. Edit: thanks for the quick fix! I would advise that a good compromise would be to change the current message from "Good news - your password was not among tho…

Thank you for your suggestion. Not a weakness anymore :)

Re: Scribd hacked – emails and hashed passwords leaked

#19

Post by yahelc »

the_french wrote: post #13
the1 wrote: post #9

Earlier quoted context omitted.

http://www.scribd.com/password/check thank you for this. now I can run a list of emails against this to see who has scribd account

They can modify it to simply say whether your account was compromised, regardless of whether you have an account (ie, if no account -> not compromised).

That's what they're doing. "aijaspijasohisaho@asoihdshohdusudhs.com" gets a message saying that that account wasn't compromised.
Post reply on HN