Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scribd hacked – emails and hashed passwords leaked

support.scribd.com

Post reply on HN
Print view View original

21–30 of 72 posts

Re: Scribd hacked – emails and hashed passwords leaked

#21

Post by smackfu »

ComputerGuru wrote: post #12

kpumunk and others, please note that http://www.scribd.com/password/check leaks information about whether or not a particular email address is in your system. It's hardly a critical weakness or anything, but just an FYI and something you may wish to reevaluate. Edit: thanks for the quick fix! I would advise that a good compromise would be to change the current message from "Good news - your password was not among tho…

Doesn't really matter, the password reset page leaks the same info and has presumably been up forever:

There is no account registered to mail 'abc@smackfu.com'.

And that's a lot harder to fix.

Re: Scribd hacked – emails and hashed passwords leaked

#22

Post by [deleted] »

the1 wrote: post #9
kpumuk wrote: post #5

Earlier quoted context omitted.

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

http://www.scribd.com/password/check thank you for this. now I can run a list of emails against this to see who has scribd account

[deleted]

Re: Scribd hacked – emails and hashed passwords leaked

#23

Post by thirsteh »

kpumuk wrote: post #5
psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

You should add this. Savvy people will be positively surprised to see a company actually caring about doing password authentication right.

Re: Scribd hacked – emails and hashed passwords leaked

#24

Post by zwegner »

kpumuk wrote: post #11
MattBearman wrote: post #7

Earlier quoted context omitted.

Thanks for clarifying, good to see you're using a decent hashing algorithm :) I'm still a little unsure of how you are able to know some users had their password compromised. Is it a simple case of finding successful log in attempts from the same IP address as attack?

Compromised != Hacked. To clarify: no accounts were accessed by the hackers, but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users. This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

This seems to imply that many of (all?) the emails/encrypted passwords were leaked, but you don't consider most of them "compromised"...

Re: Scribd hacked – emails and hashed passwords leaked

#25

Post by endianswap »

smackfu wrote: post #21
ComputerGuru wrote: post #12

kpumunk and others, please note that http://www.scribd.com/password/check leaks information about whether or not a particular email address is in your system. It's hardly a critical weakness or anything, but just an FYI and something you may wish to reevaluate. Edit: thanks for the quick fix! I would advise that a good compromise would be to change the current message from "Good news - your password was not among tho…

Doesn't really matter, the password reset page leaks the same info and has presumably been up forever: There is no account registered to mail 'abc@smackfu.com'. And that's a lot harder to fix.

Why is that harder to fix? Many sites handle it properly:

"If there was an account associated with that email address we have emailed it with instructions."

Re: Scribd hacked – emails and hashed passwords leaked

#26

Post by freehunter »

xguru wrote: post #3

bad news, it's horrible. I think different website should use different hash with salt to avoid this situation

Do you understand what salt and hash means? The algorithm may be the same, but the result is going to be different. There are many hashing algorithms, and many ways of salting the hashes. It's not always the same.

Re: Scribd hacked – emails and hashed passwords leaked

#27

Post by smackfu »

endianswap wrote: post #25
smackfu wrote: post #21

Earlier quoted context omitted.

Doesn't really matter, the password reset page leaks the same info and has presumably been up forever: There is no account registered to mail 'abc@smackfu.com'. And that's a lot harder to fix.

Why is that harder to fix? Many sites handle it properly: "If there was an account associated with that email address we have emailed it with instructions."

Since people log in with a username, not an email, they may not know which email address they associated with the account. Especially if they used a one-off to avoid spam. Personally, I prefer systems that do a reset to email after you provide a username, since usernames are often public / verifiable anyways.

Re: Scribd hacked – emails and hashed passwords leaked

#28

Post by icebraining »

kpumuk wrote: post #15
spizzo wrote: post #10

Earlier quoted context omitted.

So what do you do past this point? I know you can probably rough out how much time it would take to find hash collisions and ask as your users to change their passwords before that amount of time elapses, but past that point, can't you no longer assume that it's the actual user logging in to change their password?

We have reset passwords for all affected users. Hashes that got leaked are not useful now.

Well, that assumes people aren't reusing those passwords.

Re: Scribd hacked – emails and hashed passwords leaked

#29

Post by lelandbatey »

wuest wrote: post #17
the_french wrote: post #13

Earlier quoted context omitted.

They can modify it to simply say whether your account was compromised, regardless of whether you have an account (ie, if no account -> not compromised).

...Which they ought to do. Offering the ability to enumerate user accounts is unlikely to be the immediate goal of this utility, but it's an effect nonetheless.

30 minutes later and it's fixed. Entering an invalid email also results in a "this email was not compromised" message.

Re: Scribd hacked – emails and hashed passwords leaked

#30

Post by fabriceleal »

cddotdotslash wrote: post #8

Thankfully this doesn't read like the typical large corporation email: "...the attacker was able to gain access to all the passwords, which were stored as plaintext in the database." It sad to have to say it, but Kudos to Scribd for actually storing passwords the way they should be stored.

> (...) corporation email (...)

And even government agencies:

"UK intelligence agency stores passwords in plain text" http://www.zdnet.com/uk-intelligence-agency-stores-passwords...

Post reply on HN