Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hack of Cupid Media dating website exposes 42 million plaintext passwords

arstechnica.com

Post reply on HN
Print view View original

111–120 of 168 posts

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#111

Post by mildtrepidation »

brudgers wrote: post #90

What this story shows is that sometimes '12345' makes sense as a password - i.e. when credential security doesn't matter to the user. If I use '11111' to sign up for a onetime visit to a website, then there's no nexus with my online banking account other than an email address - assuming even the most feeble attempt at picking a 'secure' password for my banking. This is why it is often silly when articles condemn user…

This is a good argument for unique passwords, not for weak passwords. Weak passwords only "make sense" if you really don't care whether your account is compromised due to a very weak password.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#112

Post by benjamincburns »

Jtsummers wrote: post #108
sillysaurus2 wrote: post #97

Earlier quoted context omitted.

It's interesting that no one's pointed out that SRP is trivially breakable by having the client send zero as its "A" value. Of course, you can guard against that particular case. But the point is that SRP has pitfalls, just like every other solution. And those pitfalls aren't well known; the Wikipedia pseudocode makes no mention of that exploit, for example.

Yes it does [1]. In the narrative example with Steve and Carol, it states 3 safeguards. 1. Carol will abort if she receives B == 0 (mod N) or u == 0. 2. Steve will abort if he receives A (mod N) == 0. 3. Carol must show her proof of K first. If Steve detects that Carol's proof is incorrect, he must abort without showing his own proof of K. [1] Ok, the python code doesn't seem to, you're correct. However, that's less…

"Up next on VH1's Where Are They Now?, Alice and Bob!"

    Alice: At the time I thought Eve was the only one I had to worry about. Little
    did I know, Carol would be the one who'd really replace me in the end.
Edit: Hmm, downvoted. I guess humor isn't welcome here?

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#113

Post by jwcrux »

mfkp wrote: post #4

Had to look it up - unrelated to okcupid. For those interested, here's a list of their web properties: http://www.cupidmedia.com/services.cfm

> .cfm

Looks like coldfusion to me, which has had a host of vulnerabilities pop-up in the past couple years. Wouldn't be surprised if that was an easy entry point.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#114

Post by 16s »

SilkRoadie wrote: post #9

What gets me is that security professionals keep talking about layers of security. I don't understand how many recent attacks have resulted in complete breaches. Adobe had source code taken, vB gave over pretty much complete server access. You now have Cupid Media not even hashing passwords. The final defense of user information ignored.. It took me 3 days to implement password security on a legacy system. Implemente…

Often times, the hack is through a web front-end. Back-end systems (such as DBs) are heavily firewalled, logged, monitored, etc. and are generally very well protected. Systems guys (OS and DB) know security pretty well and have been doing it for a long time now.

Much of the web software that powers the front-end is complex (PHP, Java, .Net, JS, CSS, SQL, includes, 3rd-party libraries from everywhere, etc). That complexity has a broad attack surface that is difficult and time consuming to test. And many devs are late to the security party (unless we're talking OpenBSD developers).

Management wants to push out new features by X date. Devs have very little time to test and are behind on security anyway. Hackers have all the time in the world to poke at the web front-end and test every possible combination of things until they finally get in.

In a nut-shell, that's the problem as I've seen it.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#115

Post by esrauch »

nly wrote: post #39
tschellenbach wrote: post #22

Earlier quoted context omitted.

What about Facebook login (or other oauth based systems)? Seems to me this solves most of the problem.

Yes, I love trusting the keys to all my accounts to one corporation. Less tongue-in-cheek, would you trust Facebook login for banking?

Well, I do actually think the fb engineers working on login and password security are more competent than the ones that my bank currently has (8 character MAX length....). The only edge that banks have is that they know to scrutinize suspicious logins more heavily, which is something that fb would certainly do if their login was ever used for bank logins.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#116

Post by Torn »

> Making matters worse, many of the Cupid Media users are precisely the kinds of people who might be receptive to content frequently advertised in spam messages, including male enhancement products, services for singles, and diet pills.

Oh wow. So Internet dating users are generally stupid, under-endowed, desperate and overweight?

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#117

Post by albedoa »

Torn wrote: post #116

> Making matters worse, many of the Cupid Media users are precisely the kinds of people who might be receptive to content frequently advertised in spam messages, including male enhancement products, services for singles, and diet pills. Oh wow. So Internet dating users are generally stupid, under-endowed, desperate and overweight?

They wrote "many", not "generally".

And yes.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#118

Post by leoedin »

mildtrepidation wrote: post #111
brudgers wrote: post #90

What this story shows is that sometimes '12345' makes sense as a password - i.e. when credential security doesn't matter to the user. If I use '11111' to sign up for a onetime visit to a website, then there's no nexus with my online banking account other than an email address - assuming even the most feeble attempt at picking a 'secure' password for my banking. This is why it is often silly when articles condemn user…

This is a good argument for unique passwords, not for weak passwords. Weak passwords only "make sense" if you really don't care whether your account is compromised due to a very weak password.

But often you don't care. The value of a throwaway account you made to download a file is practically zero to you or an attacker. In the tradeoff in simplicity (all my crappy throwaway accounts have the password 12345... easy!) against security, simplicity wins.

If I only made an account on one of Cupid media's sites because I wanted to see a picture, I wouldn't care whether my password was easily guessable. Additionally, I'm fairly sure that an easy to make account with no access privileges is completely worthless to an attacker as well, and so the likelihood of anyone even attempting to compromise it is next to nothing.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#119

Post by alephnil »

ZoFreX wrote: post #54
Cthulhu_ wrote: post #45

Earlier quoted context omitted.

I dunno, things like this make their way to more mainstream media too, making "the general public" more conscious of security, and making them wonder whether their passwords will be secure at parties they leave them at.

The spin in mainstream media always puts the blame squarely on the hackers, and in my anecdotal experience typical users have no interest in the argument that the companies that were hacked are to blame.

Because most people have not even thought of the possibility that password can be stored in anything but plaintext, and take it as granted that all websites do. Thus the websites can't possibly be blamed, and the hackers must be the bad guys.

Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords

#120

Post by onli »

thatthatis wrote: post #53
fauigerzigerk wrote: post #24

Earlier quoted context omitted.

"The answer" doesn't exist and it never will. Everyone has to do their part. Services that store passwords in plaintext should definitely be publicly shamed, every single time.

A browser plugin that pre-hashes anything in a hidden text field (with a user secret key and the password origination domain) could mimic this as a layer on top of existing technology. It would have the obvious portability issues, and I'm sure other implementation issues.

If I understand you correctly, that exists already and is called pwdhash: https://www.pwdhash.com/.

Available online and as browser plugin for the major browsers.

The already mentioned supergenpass seems nice as well.

Post reply on HN