Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scribd hacked – emails and hashed passwords leaked

support.scribd.com

Post reply on HN
Print view View original

31–40 of 72 posts

Re: Scribd hacked – emails and hashed passwords leaked

#31

Post by dopamean »

the1 wrote: post #9
kpumuk wrote: post #5

Earlier quoted context omitted.

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

http://www.scribd.com/password/check thank you for this. now I can run a list of emails against this to see who has scribd account

I just put in a bunch of fake email addresses and they all returned with "Good news - your password has not been compromised." I think the only confirmation that youd get of an existing account is if the password was compromised.

Re: Scribd hacked – emails and hashed passwords leaked

#32

Post by sakai »

zwegner wrote: post #24
kpumuk wrote: post #11

Earlier quoted context omitted.

Compromised != Hacked. To clarify: no accounts were accessed by the hackers, but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users. This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

This seems to imply that many of (all?) the emails/encrypted passwords were leaked, but you don't consider most of them "compromised"...

I'd like to echo this concern -- were all emails/encrypted passwords leaked, but you only consider those protected by outdated hashing schemes to be compromised?

If so, I feel you have an obligation to alert ALL of your users.

Re: Scribd hacked – emails and hashed passwords leaked

#33

Post by Aardwolf »

psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

Why do you want to know the hashing scheme? Isn't it better if nobody knows? :)

Re: Scribd hacked – emails and hashed passwords leaked

#36

Post by pessimism »

psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

Back when Evernote was hacked, I got the idea of creating a draft of the kind of response I would prefer in a case like this.

I also intended to write a simple website script that could generate a statement. Things came up, and the gist has gathered dust for a while.

The gist is available here with some example cases listed that companies can learn from, and people are free to provide feedback or spin it off:

http://pygm.us/EwNHanBP

Post your most important feedback in its comments, so other companies reading the gist see it as well.

Companies definitely need to be prepared for full disclosure in the event of a security breach.

Re: Scribd hacked – emails and hashed passwords leaked

#37

Post by jasonlotito »

psycr wrote: post #6
kpumuk wrote: post #5

Earlier quoted context omitted.

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

That's good to hear. As a future suggestion to anyone else who finds themselves in this unfortunate situation - including some technical granularity in your press release can go miles in offering reassurance to your technical audience/users.

Why? Honestly asking: what difference does this have on the end result? Now that you know they are using scrypt, how will that impact your actions?

You could say that this has a bearing on whether you continue to use the service, but if that were the case, wouldn't it be better to suggest that all services provide this information up front?

Re: Scribd hacked – emails and hashed passwords leaked

#38

Post by tptacek »

kpumuk wrote: post #5
psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

That is awesome. You should feel comfortable telling people this; it puts you way ahead of the game.

Re: Scribd hacked – emails and hashed passwords leaked

#39

Post by bradleyland »

jasonlotito wrote: post #37
psycr wrote: post #6

Earlier quoted context omitted.

That's good to hear. As a future suggestion to anyone else who finds themselves in this unfortunate situation - including some technical granularity in your press release can go miles in offering reassurance to your technical audience/users.

Why? Honestly asking: what difference does this have on the end result? Now that you know they are using scrypt, how will that impact your actions? You could say that this has a bearing on whether you continue to use the service, but if that were the case, wouldn't it be better to suggest that all services provide this information up front?

You will not successfully maintain positive customer relationships by boiling all customer interactions down to questions like "how will that impact your actions [right now]?" Relationships are a string of positive and negative experiences that must be carefully curated.

The decision to remain in a relationship is rarely a singular event (related to a singular experience). You could think of it more as the cumulative result of all relationship experiences. Even the best relationships involve some negative experiences, but the important part is making sure those negative experiences are mitigated as best as possible. Customers will give more leeway to vendors with whom they have a strong NET positive relationship.

There are two important technical points that could have been included to great effect:

1) That they store the encryption scheme with the password record so that they can upgrade their crypto incrementally.

2) That their most recent auth algorithm uses scrypt.

So how do these two points directly impact the mitigation of what is otherwise a negative experience? First up we should look at users who will understand what points 1 & 2 mean. These users will respond positively to these items, because it changes the conversation from "Scribd just got h4x'd" to "Hey, at least they had good crypto in place."

The next tier of users will come along, read these comments, and feel more confident that the community of knowledgable people around them are feeling OK about this, so they should too.

As to the question of, "wouldn't it be better to suggest that all services provide this information up front?" I would say yes, it would. This action is not mutually exclusive of including technical details in this communication though.

Re: Scribd hacked – emails and hashed passwords leaked

#40

Post by streetwiseherc »

Why is email/password more attractive than billing information (credit card or bank/savings account) to hackers? What's the end goal here? I would assume that it's some sort of monetary compensation? With an email and a password, you might have access to someone's banking website, but you have to guess which bank they use and you have to assume that they used the same password. It doesn't seem practical to do a massive scripted attack against a bank's website with a possible list of emails/passwords that may or may not exist on a specific bank's web site.

Now, credit card information on the other hand might be useful. There's a black market for credit card numbers, especially if they include the verification code (CSC/CVV/etc).

If hackers have access to a site's database that contains user authentication data why are we to assume that the hackers didn't have access to payment information or that they didn't have a desire to access it?

Post reply on HN