Hack of Cupid Media dating website exposes 42 million plaintext passwords
1–10 of 168 posts
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#2Still in web 0.0 storing passwords in plain text? Awful.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#3I can't get my head around how this still happens.
I few years back I took over development of an old PHP website, which had a horrible code base (no framework or library, not even MVC). This site had around 30,000 users, all with plain text passwords.
It took me all of a couple of hours to get the site using bcrypt.
I'm not saying I'm some kind of super-rock-ninja-star developer, just that this is so easy to fix, even on monstrosity, legacy code bases.
There really is no excuse.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#4Had to look it up - unrelated to okcupid. For those interested, here's a list of their web properties: http://www.cupidmedia.com/services.cfm
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#5Just a random question: Is there anything that gives companies incentive to prevent such hacks? It seems that there is no consequences at all, except for some loss of reputation in tech community. Is there a way to put legal pressure on tightening up security?
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#6Had to look it up - unrelated to okcupid. For those interested, here's a list of their web properties: http://www.cupidmedia.com/services.cfm
Ironically, one of their sites is "OnlineDatingSafetyTips.com".
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#7This is getting ridiculous.
When are we going to see legislation enacted to take these people to task?
Surely there is a case to be made that their negligence causes (or has the potential to cause) real harm to their users.
We need a Saul Goodman to put together a class action.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#8Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing.
Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide:
https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...
The sooner we stop pretending there are no better answers than sending the contents of a password field raw over the wire, over SSL or not, and the sooner the web browser vendors and W3C start fixing this, the better. TLS-SRP is a ray of hope, but we need lighter, easier to deploy solutions that work at the application level rather than below HTTP.
On what alternate reality are we living where the W3C are working on Javascript cryptography before improving basic, fundamental, built-in authentication?
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#9What gets me is that security professionals keep talking about layers of security. I don't understand how many recent attacks have resulted in complete breaches.
Adobe had source code taken, vB gave over pretty much complete server access.
You now have Cupid Media not even hashing passwords. The final defense of user information ignored..
It took me 3 days to implement password security on a legacy system. Implemented password strength requirements. Users trying to sign in with weak passwords were flagged and forced to change their password to meet new requirements. Plain text passwords were hashed with bcrypt. One guy.. 3 days.
The UK has ICO. I would like to see these getting involved in cases like this. Where they can fine websites catering to UK users who show negligence when storing user information. If it is not currently within their powers I would like to see a law change. There should be more accountability for website owners.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#10Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing. Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide: https://en.wikipedia.org/wiki/Secur…
I agree, trusting remote services (and the communication infrastructure in between) is naïve.
Meanwhile, I use KeePass and generate a different key for each service.