in other news, 93,000 people still have a juno.com email address.
These were both for active and inactive accounts.
Adobe credentials and the serious insecurity of password hints
31–40 of 43 posts
Re: Adobe credentials and the serious insecurity of password hints
#32Great insight/writeup but the last bit gets to me: Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature. It's a classic case of someone criticizing one important feature without suggesting viable alternatives. He might as well have said, Gasoline engines are evil and they add nothing to a world that can't be achieved with a more effic…
> What's the secure password reset feature that Troy alludes to? I've seen a few concepts. One I liked was the selection of two or three images from a gallery. If the user correctly identified the ones he had selected at sign-up then a new password was sent to the registered e-mail address. But any password reset process should ensure that it never links back to the original password. Reset, not recover.
There is no way in hell I'm going to remember some pictures I picked at the time I registered which was probably 5 years ago.
It isn't going to happen.
Re: Adobe credentials and the serious insecurity of password hints
#33Earlier quoted context omitted.
I believe the question was more of how does facebook know it was the same password? My guess is this was a "lazy" calculation. That is, they had to get their users to reenter their password so they could check it then. (Make sense?)
They said in the article, they took the plaintext from the Adobe leak and hashed it using their own login algorithm, then compared hashes. Edit: wait, must have been a different article. Oh well, I read it somewhere :)
Ah, that makes a ton of sense. I was thinking in the case of if a hashed database of passwords got leaked. If you know the scheme, you could do this sort of comparison at a login. But, yeah, overly complicated for this scenario, I believe.
Re: Adobe credentials and the serious insecurity of password hints
#34Great insight/writeup but the last bit gets to me: Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature. It's a classic case of someone criticizing one important feature without suggesting viable alternatives. He might as well have said, Gasoline engines are evil and they add nothing to a world that can't be achieved with a more effic…
The viable alternative is in the sentence you quoted: "Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature." Secure password reset.
Oh, pish posh. You could've just as easily said, "The viable alternative is to make password resets secure" and said the same thing. It's doublespeak. It's basically an easy way to say, "There are a lot of different things you can do but I don't feel like taking the time to list each of the options right now."
Re: Adobe credentials and the serious insecurity of password hints
#35Earlier quoted context omitted.
The passwords were all encrypted with the same key, and ECB mode still leaks some patterns. Jeremi Gosney of Stricture Consulting Group was "fairly confident" of his decoding of many of the passwords. http://www.zdnet.com/just-how-bad-are-the-top-100-passwords-... Edit: oh it's the same guy who has this beast of a cracking cluster! http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... Edit2: more details ab…
I believe the question was more of how does facebook know it was the same password? My guess is this was a "lazy" calculation. That is, they had to get their users to reenter their password so they could check it then. (Make sense?)
To be more precise, Facebook knows hash(random_salt, facebook_password), and could do a check on the actual facebook_password when a user logs in, but I assume that it's not stored. Everyone knows encrypt(key, adobe_password), since that was what was leaked, and presumably adobe still has the key, so they know adobe_password.
Facebook wants to determine if facebook_password == adobe_password. Without the key, that's impossible. And I think 112 bit keys as provided by 3DES are still secure, even considering an adversary with the resources of Facebook.
A lot of the articles analyzing the adobe passwords seem to be comparing known-common passwords, passwords hints, and the insecurities of ECB-mode, which doesn't really scale. It seems like it would be better for facebook to just have a blacklist of common passwords (123456, password, etc), although then I suppose they don't get credit for pro-actively responding to a password leak (note: I'm not claiming that's why they're doing it - it seems like a good response, and I'm genuinely curious how they're doing it).
Edit: I just thought of way they could do it. Generate a histogram over the first 8 bytes of each encrypted password. Pick a threshold (e.g. 2, or 10, but you'd have to look at the data to get a good number) above which the password is considered "common" and therefore insecure. Go through the list of email addresses in the adobe dump that have a "common" password, and if there's a facebook account with that email address force a password reset. That seems like it would work fairly well, and doesn't require any knowledge of the plaintext passwords.
Re: Adobe credentials and the serious insecurity of password hints
#36> Password hints are an absolutely ridiculous security measure.
Password hints have multiple uses. For identity management and verification systems, it's used as an additional identity check after the password if the host seems to have changed. For password recovery, it's a "need to know" factor you have to pass before you get to the "need to have" of e-mail account access. Since it's trivial to bruteforce, multiple hints of different categories are usually deployed.
In the real world, hackers compromise accounts by finding out the personal details they need to subvert password-recovery steps. Find the last four of the social, their birth date, address, and phone number, and you can basically hijack any bank, telephone, utility or government account a person has. Password hints are (when properly implemented) more secure because they can leverage other access methods.
Did they need to keep the hint plaintext? No; they can hash it just like any other password. But as the complexity requirement of the hint is much lower than that of passwords, it should be required to use another factor (such as an e-mailed confirmation code, SMS, or many more hints or sensitive information) to allow the hint to succeed.
Re: Adobe credentials and the serious insecurity of password hints
#37I don't have the resources of a Facebook, but I'd pay a few hundred bucks a year for a HTTPS secured REST API which let me post an email address and receive a list of candidate passwords. Bonus for a callback if someone I've queried gets added. The service would maintain that list in a fashion similar to whitehat security researchers. Use case is to implement the FB-style security escalation for high-value accounts a…
The noise you hear is five hundred patio11 followers writing that app... myself included :)
The app part is trivial, the hard part would be maintaining good up to date datasets to make this actuallly useful. You'd also need quite a few more costumers than one patio11 to make it worth your while, and ironically, the need for this service in the first place suggests the potential market is still small.
I.e. lots of organizations don't quite realize they have a need for this and would have a hard time understanding why its useful.
Re: Adobe credentials and the serious insecurity of password hints
#38I got Ghostery installed, the page loads and then suddenly the text of the article is removed. I know I know, I just shouldn't use Ghostery but I like to have a little privacy online. Sorry I won't return to your site again...
Err, we've got a bug in Ghostery 5.0 for Disqus specifically that will be fixed in 5.1. Its related to click-2-play, so you may either disable it in Ghostery advanced options, or unblcok disqus on the site.
Re: Adobe credentials and the serious insecurity of password hints
#39I got Ghostery installed, the page loads and then suddenly the text of the article is removed. I know I know, I just shouldn't use Ghostery but I like to have a little privacy online. Sorry I won't return to your site again...
Don't use Ghostery because they're tracking you: http://en.wikipedia.org/wiki/Ghostery#Criticism Try disconnect.me or blacklisting the sites directly from the hosts file.
I think the wikipedia entry is pretty clear that its an opt-in program that requires the user to check an option in the setup or options of Ghostery.
As far as other products, heres a handy chart we generate monthly to see which extension protects better: http://www.areweprivateyet.com/
Re: Adobe credentials and the serious insecurity of password hints
#40I changed my password to "photoshop", because I was expecting an advice from adobe telling me to pick something more secure, nothing happened :/