Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hack of Cupid Media dating website exposes 42 million plaintext passwords

arstechnica.com

Post reply on HN
Print view View original

41–50 of 168 posts

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#41

Post by sdoering »

markdown wrote: post #25
camus2 wrote: post #11

Earlier quoted context omitted.

> When are we going to see legislation enacted to take these people to task? And how would you enforce this ? mandated paid audits provided by companies that have lobbyists and friends in Washington ? Enough with the laws, laws are not an answer to every problems. If there is harm , let the users sue, but stop with your laws...

> And how would you enforce this ? ... mandated paid audits No, that would be quite silly and wouldn't work. It could simply be reactive rather than proactive. When an incident occurs where sensitive user data is exposed, simply launch an investigation into whether there were "adequate" protections in place. If it is found that sensitive data was stored unencrypted, for example, put the directors of the company behin…

Even more simpler:

If "adequate" protections are missing: Pay every breached user $10.

That way such a breach gets a hefty price-tag and devs/PMs could argue with management, that it is economically feasible to implement these measures.

I know of a PM, that tells devs, that report security-problems inside his product, that they should not care, but instead finish "that news shiny little thing" and that that is their job in his opinion, not detect some strange security-problem.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#42

Post by mattmanser »

jiggy2011 wrote: post #27
mattmanser wrote: post #14

Earlier quoted context omitted.

Because of this: If a site is using plaintext password often the owner asked for it. They wanted their users to be able to recover their passwords. And the dev didn't understand why this was a bad idea. They need to be educated, convinced and then convinced that the time you're about to spend on fixing this is more important than the 101 other things going wrong because the original dev wasn't very good. And isn't ac…

It's quite possible the dev knew it was a bad idea and maybe even argued against it but was told to implement it this way anyway. The problem a dating site probably has is people who sign up accounts and then stop using them. They want to send these users reminder emails in the hope that some of them re-engage. Problem is that some of these users have probably forgotten which password they use for that website, and s…

Yeah, I'm being a bit hard on the original dev!

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#43

Post by fauigerzigerk »

jiggy2011 wrote: post #29
fauigerzigerk wrote: post #24

Earlier quoted context omitted.

"The answer" doesn't exist and it never will. Everyone has to do their part. Services that store passwords in plaintext should definitely be publicly shamed, every single time.

The problem is that "publicly shamed" means "shamed amongst security geeks". Most websites main demographic is not security geeks.

It means being shamed among tech professionals and that's exactly the community in which those responsible for the disaster have to spend the rest of their professional lives. Peer pressure is very effective.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#44

Post by nly »

chalst wrote: post #34
tschellenbach wrote: post #22

Earlier quoted context omitted.

What about Facebook login (or other oauth based systems)? Seems to me this solves most of the problem.

It solves the problem with offline password cracking, but it introduces the need to trust a third party. Since the client side of SRP can be implemented in Javascript [1,2,3], there's not really much in the way of compelling reasons not to use it. [1]: There's a client in the SRP bundle at http://srp.stanford.edu/download.html [2]: https://github.com/symeapp/srp-client [3]: https://github.com/clipperz/javascript-cryp…

One of the key aspects of SRP is it provides mutual authentication. The server is considered untrusted until authenticated. If you run it in Javascript you lose the benefits it has over simple challenge-response client authentication.

TLS-SRP could replace ordinary CA based server authentication, but I think there's a middle ground somewhere. Both are complimentary. CAs should be authenticating servers to my browser, and SRP should be authenticating servers to me.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#45

Post by Cthulhu_ »

jiggy2011 wrote: post #29
fauigerzigerk wrote: post #24

Earlier quoted context omitted.

"The answer" doesn't exist and it never will. Everyone has to do their part. Services that store passwords in plaintext should definitely be publicly shamed, every single time.

The problem is that "publicly shamed" means "shamed amongst security geeks". Most websites main demographic is not security geeks.

I dunno, things like this make their way to more mainstream media too, making "the general public" more conscious of security, and making them wonder whether their passwords will be secure at parties they leave them at.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#46

Post by mortehu »

relix wrote: post #31
jiggy2011 wrote: post #27

Earlier quoted context omitted.

It's quite possible the dev knew it was a bad idea and maybe even argued against it but was told to implement it this way anyway. The problem a dating site probably has is people who sign up accounts and then stop using them. They want to send these users reminder emails in the hope that some of them re-engage. Problem is that some of these users have probably forgotten which password they use for that website, and s…

I include an "Instant Login" link in each mail so the users don't need to remember their password. It contains a unique time-sensitive token to identify the user and instantly sign them in (much like a password reset). I learned this technique from OKCupid, so no idea why they still had plaintext passwords.

It turns out Cupid Media is unrelated to OkCupid.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#47

Post by shubb »

sdoering wrote: post #41
markdown wrote: post #25

Earlier quoted context omitted.

> And how would you enforce this ? ... mandated paid audits No, that would be quite silly and wouldn't work. It could simply be reactive rather than proactive. When an incident occurs where sensitive user data is exposed, simply launch an investigation into whether there were "adequate" protections in place. If it is found that sensitive data was stored unencrypted, for example, put the directors of the company behin…

Even more simpler: If "adequate" protections are missing: Pay every breached user $10. That way such a breach gets a hefty price-tag and devs/PMs could argue with management, that it is economically feasible to implement these measures. I know of a PM, that tells devs, that report security-problems inside his product, that they should not care, but instead finish "that news shiny little thing" and that that is their…

Well, what would happen would be, any sane bushiness would take out insurance, and the insurance companies would mandate / audit security best practices.

If a shop wants to insure it's stock, the insurance company tell them what they need. An alarm? Big metal shutters? A night guard. Depends what you are guarding.

In practice, a password is pretty valuable. Not to the company, but the loss to the user can be pretty significant.

In the UK, the Data Protection Act does allow fines against companies that fail to encrypt specific information (inc passwords). They handed out 2.5MM in fines last year, but I think they mostly go after people selling data, rather than just messing up and losing it.

Recent UK fines: http://www.ico.org.uk/enforcement/fines

OH WOW they fined sony after the geohotz hack http://www.ico.org.uk/enforcement/~/media/documents/library/... (only £200'000, but still)

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#48

Post by jiggy2011 »

fauigerzigerk wrote: post #43
jiggy2011 wrote: post #29

Earlier quoted context omitted.

The problem is that "publicly shamed" means "shamed amongst security geeks". Most websites main demographic is not security geeks.

It means being shamed among tech professionals and that's exactly the community in which those responsible for the disaster have to spend the rest of their professional lives. Peer pressure is very effective.

We don't even know specifically who is responsible for this particular thing, as I've mentioned in other comments it's likely this came from some non tech person anyway.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#49

Post by nly »

jacques_chester wrote: post #40
nly wrote: post #8

Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing. Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide: https://en.wikipedia.org/wiki/Secur…

This is an is/ought fallacy. As professionals we don't get to propose the ideal universe as the solution to the problems of the actual universe. We have to take what we can get right now.

And that's a false dichotomy. Are you saying we should dismiss dangerous flaws in the trust model, just because we have some workarounds for bad industry practice, and can 'make do'? because I'm not saying we shouldn't advocate strengthening existing databases right now. To me, the two concerns are completely separate.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#50

Post by adventured »

TomGullen wrote: post #32
danenania wrote: post #30

Earlier quoted context omitted.

Yes, the government would surely do a great job legislating development standards. Just look how terrifically they've handled software patents.

Free markets currently doing a pretty awful job of it as we keep learning. Perhaps some government legislation would help.

You can't legislate away stupid behavior.

There will always be an endless parade of poor choices. If it's not 'this,' it's 'that' and then the next 'thing.' There is no scenario under which a government entity can enforce, keep up with, or properly control such.

Post reply on HN