Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers raid eBay in historic breach, access 145 million records

reuters.com

Post reply on HN
Print view View original

51–60 of 100 posts

Re: Hackers raid eBay in historic breach, access 145 million records

#51

Post by jacquesm »

robomartin wrote: post #22

Just changed it. I don't understand why eBay (and others) don't offer two-factor authentication. Of course this wouldn't have prevented the data theft but at least one can have a reasonable degree of certainty that your individual account will not be compromised with a simple password. I also strongly suggest that you change the answer to the one-and-only secret question to something completely unrelated. For example…

I don't understand why after a breach of this magnitude people continue to use a service, but just change their passwords and then move on.

Re: Hackers raid eBay in historic breach, access 145 million records

#52

Post by dchest »

nly wrote: post #45
dchest wrote: post #39

Earlier quoted context omitted.

There is no usable secure password authentication standard that will protect from password compromise after password database leak. In fact, if you're talking about SRP, it's worse in this regard compared to, say, using bcrypt.

SRP as published in RFC2945 (circa 2000), which uses SHA-1, is worse. The protocol and general idea is a lot better, and can be adapted to use any hash function you like. Replacing RSA with EC is also trivial. Half a day and a room full of cryptographers and browser guys and you could RFC these changes. Given more time, I have no doubt that they could come up with something entirely new and web-centric. We have a sta…

Again, SRP is useless against password database leaks. Even if it's used with scrypt instead of SHA-1, and ECC instead of RSA, it's no better than scrypt.

There is no standard not because nobody invented it, but because it's impossible in principle (unless we replace passwords with something else).

Re: Hackers raid eBay in historic breach, access 145 million records

#53

Post by jacquesm »

lena wrote: post #28

Is it safe to change my password now? All I read in the article is how much they are investigating this. How do I know the hackers don't still have access and are now actively monitoring password changes potentially getting more info? I am concerned that there is nothing about this on the eBay front page and that I have not received an email from eBay about this

I wonder if this means the dutch auction site 'Marktplaats' also had its data copied. PayPal is apparently in the clear (not that I would ever use them again), but I do have a Marktplaats account and that's an ebay subsidiary. (they got bought out after ebay realized they were not going to be able to out-compete them).

Re: Hackers raid eBay in historic breach, access 145 million records

#54

Post by dchest »

perlgeek wrote: post #49
dchest wrote: post #33

Earlier quoted context omitted.

Could you elaborate on that?

Many breaches in the past revealed that passwords were somehow "hashed" or "encrypted" in ways that made it much easier than necessary for the attacker to obtain the clear text passwords. For example if passwords are only hashed with md5, with no salt, that's basically worthless; md5 is simply too easy to brute force. Same for sha1 (not quite as easy to reverse, but rainbow tables help). So the mere fact that the pas…

I know that different password storage schemes provide different security. I don't see how knowing what particular scheme they used would affect your actions.

Re: Hackers raid eBay in historic breach, access 145 million records

#55

Post by dchest »

tombrossman wrote: post #48
dchest wrote: post #33

Earlier quoted context omitted.

Could you elaborate on that?

I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s). If the attackers got plaintext data (worst-case) and users re-used logins on other sites, it's a 'holy shit drop everything and change passwords now' moment. If Ebay followed best practices then affected users know they can wait a day or two and update passwords at a convenient time. Has…

Passwords leaked 3 months ago, it's "holy shit drop everything and change passwords now" moment in any case.

Re: Hackers raid eBay in historic breach, access 145 million records

#56

Post by fatbat »

ghshephard wrote: post #7

Here is what I get when I try and change my password: Page not available Ebay is asking its users to reset their passwords due to the unauthorized access to our corporate information network. This may result in a delay of service due to the high traffic volume. We ask for your patience and that you return to eBay soon. I wouldn't think that "password changes" were really that heavy a function. Edit - Finally got thro…

Actually having difficulty even locating where to change my eBay password!

Also I did not receive ANY emails from eBay regarding this. Not sure if it meant my account was not affected, or it is just taking a while...

( EDIT: Finally found it, http://ocsnext.ebay.com/ocs/sr?st=1&query=How%20do%20I%20cha...? )

Re: Hackers raid eBay in historic breach, access 145 million records

#57

Post by nly »

dchest wrote: post #52
nly wrote: post #45

Earlier quoted context omitted.

SRP as published in RFC2945 (circa 2000), which uses SHA-1, is worse. The protocol and general idea is a lot better, and can be adapted to use any hash function you like. Replacing RSA with EC is also trivial. Half a day and a room full of cryptographers and browser guys and you could RFC these changes. Given more time, I have no doubt that they could come up with something entirely new and web-centric. We have a sta…

Again, SRP is useless against password database leaks. Even if it's used with scrypt instead of SHA-1, and ECC instead of RSA, it's no better than scrypt. There is no standard not because nobody invented it, but because it's impossible in principle (unless we replace passwords with something else).

SRP does offer reassurance when databases are compromised. If my browser supported SRP-EC-Scrypt, and users were guided on password strength by their browsers UI, then there would be negligible public concern regarding 'encrypted passwords' being leaked, or worry about whether eBay or HN is using MD5 or leaking HTTP POST requests somewhere.

Not to mention SRP verifiers are public keys. Password derived pubkeys like those in SRP can be used to securely encrypt other sensitive user data while still allowing users to decrypt and maintain those records interactively.

A good solution isn't "impossible in principle", we just need a full-stack solution extending from browser UI all the way to your favourite CRUD webapps database. Most of that complexity falls to the browser vendors, web application frameworks and languages would jump all over it once there was a client-side consensus.

We need to change our trust models. I trust eBay as an organisation to offer me a service. I don't trust the web stack or their servers.

Re: Hackers raid eBay in historic breach, access 145 million records

#58

Post by dchest »

nly wrote: post #57
dchest wrote: post #52

Earlier quoted context omitted.

Again, SRP is useless against password database leaks. Even if it's used with scrypt instead of SHA-1, and ECC instead of RSA, it's no better than scrypt. There is no standard not because nobody invented it, but because it's impossible in principle (unless we replace passwords with something else).

SRP does offer reassurance when databases are compromised. If my browser supported SRP-EC-Scrypt, and users were guided on password strength by their browsers UI, then there would be negligible public concern regarding 'encrypted passwords' being leaked, or worry about whether eBay or HN is using MD5 or leaking HTTP POST requests somewhere. Not to mention SRP verifiers are public keys. Password derived pubkeys like t…

It's true that if your browser and websites supported SRP-EC-Scrypt, you would know that they stored things "securely". However, this won't solve the problem of people using weak passwords and people using the same password for different websites. If you use strong passwords and don't reuse them, you already know your risks.

As for your second point, I don't understand it. Do you mean, with the help of SRP, you can store some sensitive data on server, which won't be available to this server, but will be available to user? What's the use of it? This sounds strangely similar to this idea: https://www.w3.org/Bugs/Public/show_bug.cgi?id=25721

> We need to change our trust models. I trust eBay as an organisation to offer me a service. I don't trust the web stack or their servers.

Then passwords don't matter, because you assume that attackers already can do everything with your eBay account.

Re: Hackers raid eBay in historic breach, access 145 million records

#59

Post by nly »

dchest wrote: post #58
nly wrote: post #57

Earlier quoted context omitted.

SRP does offer reassurance when databases are compromised. If my browser supported SRP-EC-Scrypt, and users were guided on password strength by their browsers UI, then there would be negligible public concern regarding 'encrypted passwords' being leaked, or worry about whether eBay or HN is using MD5 or leaking HTTP POST requests somewhere. Not to mention SRP verifiers are public keys. Password derived pubkeys like t…

It's true that if your browser and websites supported SRP-EC-Scrypt, you would know that they stored things "securely". However, this won't solve the problem of people using weak passwords and people using the same password for different websites. If you use strong passwords and don't reuse them, you already know your risks. As for your second point, I don't understand it. Do you mean, with the help of SRP, you can s…

> If you use strong passwords and don't reuse them, you already know your risks.

Nobody does this. Geeks who use password management are are an extreme minority, and solutions like LastPass are crock that solve the same problem by papering over infrastructural failings and mean users are never completely free to move.

Anecdotally I believe people typically use a 'good password' for banking etc, and a handful of lazy passwords. Cryptographically speaking, they're all weak of course, but imho people are better off with knowing one or two really good passwords (I used a 12 character mixed case password containing symbols entirely from QWERTY induced muscle memory) and letting their browser deal with derivation for different endpoints.

> Do you mean, with the help of SRP, you can store some sensitive data on server, which won't be available to this server, but will be available to user?

Not SRP specifically. Forget SRP. What I mean is generally that any user public key (whether it was originally derived from a user secret like a password or not) can be used by an organisation for online encryption and authentication and offline decryption, where data can be decrypted by either the organisation using their private key, or by the user using their password.

Re: Hackers raid eBay in historic breach, access 145 million records

#60

Post by iLoch »

khoitran19 wrote: post #27

Can someone please help me understand why their stock price was not impacted by this? I observed Target when similar incident happened and nothing seemed to change. Is the general market neglecting security exploitations or is the damage too small for those big companies? I personally think that it's a big hit for the companies. They will have to spend money to patch it up and also lose trusts from users.

Turns out most people probably don't give a shit and likely won't change their passwords now unless they're forced.
Post reply on HN