Earlier quoted context omitted.
You need to know how they store passwords because ... what?
So we can understand the risk of compromise.
'Maybe it will be ok' is not a good strategy regardless of what you think you know about the situation.
Hackers raid eBay in historic breach, access 145 million records
41–50 of 100 posts
Re: Hackers raid eBay in historic breach, access 145 million records
#42Just changed it. I don't understand why eBay (and others) don't offer two-factor authentication. Of course this wouldn't have prevented the data theft but at least one can have a reasonable degree of certainty that your individual account will not be compromised with a simple password. I also strongly suggest that you change the answer to the one-and-only secret question to something completely unrelated. For example…
> I don't understand why eBay (and others) don't offer two-factor authentication
eBay implements 2-factor auth via a PayPal s/Key hardware token.
Re: Hackers raid eBay in historic breach, access 145 million records
#43Earlier quoted context omitted.
Could you elaborate on that?
because how the passwords are stored affects whether they are recoverable. are you dense?
That's not an actionable information. There is no reason not to change password and not use different passwords for different websites even if they use yescrypt* with 2 TB ROM.
Re: Hackers raid eBay in historic breach, access 145 million records
#44Earlier quoted context omitted.
Make a law. I don't think there are actual laws in place that hold companies liable when stuff like this happens. I don't even think they are required to have regular security audits.
Not sure about the US laws, but in South Africa we have the Protection of Personal Information Act (Popi) and it became law on November 26 2013. "Popi essentially regulates how anyone who processes personal information must handle, keep and secure that information. Personal Information broadly means any information relating to an identifiable, living natural person or juristic person (companies, CC’s etc.) and includ…
Same in NL; I'm not sure about the implementation details of the law though. At the very least, all personal data needs to be transmitted over HTTPS; I'm not sure if the law makes demands of back-end storage though. It probably doesn't cover passwords.
Re: Hackers raid eBay in historic breach, access 145 million records
#45How many billion $ companies will it take before we finally rid ourselves of plain-text password authentication (regardless of whether or not it's performed over TLS, or they're using a 'good' hash function for verification)? The lack of a usable secure password authentication standards for the web is the most pressing issue in web security these days. If there's one thing in the next HTML standard that should be dep…
There is no usable secure password authentication standard that will protect from password compromise after password database leak. In fact, if you're talking about SRP, it's worse in this regard compared to, say, using bcrypt.
SRP as published in RFC2945 (circa 2000), which uses SHA-1, is worse. The protocol and general idea is a lot better, and can be adapted to use any hash function you like. Replacing RSA with EC is also trivial. Half a day and a room full of cryptographers and browser guys and you could RFC these changes. Given more time, I have no doubt that they could come up with something entirely new and web-centric.
We have a standards body responsible for stewarding the web, and a handful of some very smart and well resourced browser vendors who can solve these problems. Ultimately these guys have to take this burden eventually, and these people write web standards... not having a standard yet just isn't an excuse.
Why aren't they doing so? Is it because they're more interested in pushing their own platforms and authentication solutions (hint: all 3rd party authentication is horrific). It's not like Google, to pick one, is shy when it comes to developing their own protocols. And it's not just protocols... why don't browsers come with cracklib style hints regarding password strength yet? Why no builtin password generation to go with the existing password storage? So many things not being done because it's easier to blame the next company when their database is compromised than cooperating to solve hard technological and UI failings.
Re: Hackers raid eBay in historic breach, access 145 million records
#46How many billion $ companies will it take before we finally rid ourselves of plain-text password authentication (regardless of whether or not it's performed over TLS, or they're using a 'good' hash function for verification)? The lack of a usable secure password authentication standards for the web is the most pressing issue in web security these days. If there's one thing in the next HTML standard that should be dep…
They don't even allow pasting into the change password field, making using a password manager much harder. Why on earth do people things that's a good idea??!?
Re: Hackers raid eBay in historic breach, access 145 million records
#47Nice intrusion detection system they have there. And being able to exfiltrate a chunk of data that size without any alarms going off does not bode well. For all you know there is now a copy of the full db living somewhere else, not just the userdata but also every trade those users ever made. This would allow a whole bunch of other trouble to happen given that addresses and other information were also present in the data taken.
For instance, this could be used to set up a series of targeted raids along the lines of what some gangs have done in Europe in the last decade.
Knowing who has expendable money, buys fancy art, expensive jewelery, what it looks like and so on could help a lot during the planning of such an excursion.
Re: Hackers raid eBay in historic breach, access 145 million records
#48Earlier quoted context omitted.
So we can understand the risk of compromise.
Could you elaborate on that?
I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s).
If the attackers got plaintext data (worst-case) and users re-used logins on other sites, it's a 'holy shit drop everything and change passwords now' moment.
If Ebay followed best practices then affected users know they can wait a day or two and update passwords at a convenient time. Hashing, salting, encrypting all buy you time to react.
Your other comment is correct though, once a password database is compromised all those affected must assume it will be cracked and so they must change passwords. The only variable is how quickly they should act.
Re: Hackers raid eBay in historic breach, access 145 million records
#49Earlier quoted context omitted.
So we can understand the risk of compromise.
Could you elaborate on that?
Many breaches in the past revealed that passwords were somehow "hashed" or "encrypted" in ways that made it much easier than necessary for the attacker to obtain the clear text passwords.
For example if passwords are only hashed with md5, with no salt, that's basically worthless; md5 is simply too easy to brute force. Same for sha1 (not quite as easy to reverse, but rainbow tables help).
So the mere fact that the passwords were somehow "secured" doesn't mean much by itself.
Re: Hackers raid eBay in historic breach, access 145 million records
#50Amazon is probably next.
It probably isn't for lack of trying that this has not happened.