Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubisoft hacked, account data compromised

support.ubi.com

Post reply on HN
Print view View original

71–80 of 104 posts

Re: Ubisoft hacked, account data compromised

#71

Post by kzahel »

zachlatta wrote: post #14
codereflection wrote: post #2

I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.

I've been looking for a Lastpass alternative forever. Had no idea Dashlane existed, thanks!

I was inspired by a blog post I saw here and ended up creating a chrome web store app and an android app for creating site-specific passwords based on a master password.

https://github.com/kzahel/passwordmaker https://github.com/kzahel/passwordmaker_android

I simply don't trust 1password, lastpass, etc.

The one problem I have is that many websites place artificial restrictions on password length, types of non-alphanumeric characters, requirements on number of numeric digits, etc. It would be nice if there were an updated collaborative list of these artificial restrictions somewhere.

Currently I simply update the password generator to conform to these restrictions whenever I need to create a password for a dumb website.

Re: Ubisoft hacked, account data compromised

#72

Post by Brandon0 »

cookiecaper wrote: post #38
groby_b wrote: post #31

Earlier quoted context omitted.

Yes. It's a DoS vector. The question is, what is a reasonable limit - and 16 characters fails horribly in that section.

Right, as the OP said, there is no reasonable excuse to limit character intake to less than multiple hundreds. I agree that some limit is sensible just to ensure someone doesn't insert War and Peace (or base64-encoded binaries or whatever) as their password.

I was using War and Peace -- now I have to go change my passwords. Thanks!

Re: Ubisoft hacked, account data compromised

#73

Post by Brandon0 »

dansanderson wrote: post #67

They sent a notification email to every customer asking them to change their password. The email includes the user's current password. I know this because I received such an email-- intended for someone else who accidentally used my email address for their account. So not only is Ubisoft storing raw passwords and sending them via email, they're not verifying email addresses during account creation.

No way, really? According to the article they claim to "encrypt" the passwords (they actually mean hash). Any way you could post the contents of the email (minus the personal details)?

Re: Ubisoft hacked, account data compromised

#74

Post by shabble »

xyzzyz wrote: post #60
daeken wrote: post #36

Earlier quoted context omitted.

I'm going to speak strongly against the prevailing view in the security community here: a forgot password email/username oracle is not an issue . Not in any way, shape, or form. Why? Because if I go to register an account with a given email or username, it's going to tell me if that account is already registered! Unless you make multiple accounts with a given username/email possible (please, please don't do that), th…

How about this: when you register an account with an already existing email, the website returns the same message as it would if the email didn't already exist: "The account have been created, but needs to be activated. Click on the link in the activation email that has been sent to your email address.". Now, the email that is actually sent says "Someone tried to create an account with your email address. If it was y…

This does seem like a reasonable approach, but would definitely need a rate-limiting system/opt-out to avoid intentional activate-mail DoS to the actual address owner.

Might also help whoever has foo@bar.com and similar, too.

Re: Ubisoft hacked, account data compromised

#75

Post by dclowd9901 »

Brandon0 wrote: post #73
dansanderson wrote: post #67

They sent a notification email to every customer asking them to change their password. The email includes the user's current password. I know this because I received such an email-- intended for someone else who accidentally used my email address for their account. So not only is Ubisoft storing raw passwords and sending them via email, they're not verifying email addresses during account creation.

No way, really? According to the article they claim to "encrypt" the passwords (they actually mean hash). Any way you could post the contents of the email (minus the personal details)?

I think he's misunderstanding the email:

>As a result, we are recommending that you change the password for your account: dclowd9901

All I see is the plaintext representation of my username.

Re: Ubisoft hacked, account data compromised

#76

Post by Hello71 »

just2n wrote: post #59
quaunaut wrote: post #26

Earlier quoted context omitted.

There's no reason to limit the length of passwords whatsoever, except perhaps to be sure you're not trying to hash 20mb of text.

You could really support an arbitrary password size by locally hashing the password to a length at least as long as the one you store in the database to preserve entropy, then send the fixed length hash as the user's "password", and hash it again on the server using something slower, like PBKDF2 with a few thousand rounds.

How do you think hashing functions work?

Re: Ubisoft hacked, account data compromised

#77

Post by y0ghur7_xxx »

eksith wrote: post #5
codereflection wrote: post #2

I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.

As an alternative, you could GPG a text file with all passwords and use... hexdump -n 16 -v -e '/1 "%02X"' /dev/urandom ...as a password generator

I'm using

  cat /dev/urandom |base64 |head -c20 && echo

Re: Ubisoft hacked, account data compromised

#78

Post by recursive »

mattmanser wrote: post #53
andrewmunsell wrote: post #44

Earlier quoted context omitted.

Unfortunately, I have to disagree. In fact, there are some large vendors of software that truly use encryption instead of some form of one way hashing. Sadly, I have to deal with software like this and there's no chance it's going to change any time soon.

It's a built-in feature of ASP.Net's membership provider (user accounts for those not knowing MS's Enterprise Obfuscation Naming And Extension Standard).

But that behavior is configurable.

Re: Ubisoft hacked, account data compromised

#79

Post by [deleted] »

eksith wrote: post #5
codereflection wrote: post #2

I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.

As an alternative, you could GPG a text file with all passwords and use... hexdump -n 16 -v -e '/1 "%02X"' /dev/urandom ...as a password generator

[deleted]

Re: Ubisoft hacked, account data compromised

#80

Post by TillE »

Hello71 wrote: post #76
just2n wrote: post #59

Earlier quoted context omitted.

You could really support an arbitrary password size by locally hashing the password to a length at least as long as the one you store in the database to preserve entropy, then send the fixed length hash as the user's "password", and hash it again on the server using something slower, like PBKDF2 with a few thousand rounds.

How do you think hashing functions work?

At least on the web, hashing isn't usually done locally (ie, in Javascript).
Post reply on HN