Ubisoft hacked, account data compromised • Hacker News Board

Re: Ubisoft hacked, account data compromised

#101

Post by deelowe » Wed, Jul 03, 2013, 11:32 AM UTC

zachlatta wrote: post #96

deelowe wrote: post #55

Earlier quoted context omitted.

Ahh. OK. One small nit. Passwords aren't stored, the has is. If you forget your lastpass password, there's no way to retrieve them. I'm OK with this, which is why I continue to use lastpass. That said, the interface is definitely terrible. It could use a refresh at this point.

What does "the has is" mean? To my understanding, encrypted passwords are stored on the company's servers and they are decrypted on the client-side. I don't know how they're storing their data, but I do know that we never know what the future holds. Those passwords that may be secure on their server today may easily be broken tomorrow. I'd rather by in control of my data.

My apologies. You are correct. I wrote hash(actually typed "has") when I really meant that they are stored encrypted. I forget the algorithm that's used, but my understanding last I looked into it, the encryption lastpass uses is the best available.

Re: Ubisoft hacked, account data compromised

#102

Post by alexjeffrey » Wed, Jul 03, 2013, 11:39 AM UTC

just2n wrote: post #100

alexjeffrey wrote: post #99

Earlier quoted context omitted.

no it doesn't remove any security, but why implement a feature that doesn't add anything?

It does add something: users can use any password they want. Any unicode string. You just UTF-8 encode then locally hash into a constant size. This alleviates the issue mentioned in the grandparent that supporting arbitrary length passwords introduces a DoS vector, especially when a slow hash is used on the server.

arbitrary length passwords simply aren't necessary though, and are unlikely to be used - if you were to cap passwords at, say, 128 characters, who would run into that limit?

I'm not arguing that if this functionality were already present in an app that you should remove it; however if it's not there already there's very little value it could add that would justify any development time. That's just my opinion though.

Re: Ubisoft hacked, account data compromised

#103

Post by throwaway125 » Wed, Jul 03, 2013, 4:00 PM UTC

nknighthb wrote: post #83

quaunaut wrote: post #26

Earlier quoted context omitted.

There's no reason to limit the length of passwords whatsoever, except perhaps to be sure you're not trying to hash 20mb of text.

I won't say 20MB passwords wouldn't pose any practical problems, but the hashing itself isn't really an issue. A simple bcrypt test on my laptop (w/work factor 12) gave me these numbers: 1KB: 0.279 secs 1MB: 0.277 10MB: 0.293 100MB: 0.473 1000MB: 2.169 Getting the 1GB string allocated in Python locked my system up for longer than the 20 loops over bcrypt did. :) I should probably find a machine with a little more RAM…

now enter the first 72 characters of that password in the bcrypt verification function and it'll still say it's correct. bcrypt is a valid technical reason to limit passwords to 72 characters.

Re: Ubisoft hacked, account data compromised

#104

Post by dansanderson » Thu, Jul 04, 2013, 6:21 AM UTC

dclowd9901 wrote: post #75

Brandon0 wrote: post #73

Earlier quoted context omitted.

No way, really? According to the article they claim to "encrypt" the passwords (they actually mean hash). Any way you could post the contents of the email (minus the personal details)?

I think he's misunderstanding the email: >As a result, we are recommending that you change the password for your account: dclowd9901 All I see is the plaintext representation of my username.

Ah, glad to have that clarified. The username in the misdelivered email I received looked very much like an attempt at a memorable password, not a username. Thanks!