Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers raid eBay in historic breach, access 145 million records

reuters.com

Post reply on HN
Print view View original

71–80 of 100 posts

Re: Hackers raid eBay in historic breach, access 145 million records

#71

Post by dchest »

sgk284 wrote: post #69
dchest wrote: post #54

Earlier quoted context omitted.

I know that different password storage schemes provide different security. I don't see how knowing what particular scheme they used would affect your actions.

If you use a secure password and the scheme the company uses is something like scrypt or bcrypt with high work factors, you can be near-certain that your password won't be cracked by an attacker. The amount of computation is just extraordinary. That said, you would still probably want to change your password if you're paranoid.

If you are capable of estimating the cost of cracking your password, you're capable of understanding that you should use different passwords on different websites and that you should change your password in event of compromise. In which case, the fact that attackers know your leaked password doesn't change anything.

The same thing applies to knowing the particular password hash they used: if your password had enough entropy, attackers won't be able to break it even if eBay used "unsalted" SHA-1. But this doesn't change anything, because see previous paragraph.

If, say, your grandfather used the same password for Hotmail and eBay, and he tells you that his password was "bestjetpilot"[1], and asks for your advice on what to do, will you tell him to change both passwords, or just the eBay one? What if he used "y62BYmHoCsjScov6QSOgGCL"? What would you tell him? How would your advice change if you knew the particular password storage scheme eBay used? Do you now need to know which scheme Hotmail uses, because the password is reused on both websites?

[1] http://pages.ebay.com.au/help/account/create-password.html

Re: Hackers raid eBay in historic breach, access 145 million records

#72

Post by mnw21cam »

MasterScrat wrote: post #63
tombrossman wrote: post #48

Earlier quoted context omitted.

I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s). If the attackers got plaintext data (worst-case) and users re-used logins on other sites, it's a 'holy shit drop everything and change passwords now' moment. If Ebay followed best practices then affected users know they can wait a day or two and update passwords at a convenient time. Has…

If used properly, can't the good hashing techniques be "safe", at least if the salt is not leaked?

You're thinking of pepper, not salt.

Salt is a random value that is added to a password before it is hashed, so that two identical passwords do not hash to the same value. The value is different for each hashed password, and is stored alongside the hash.

Pepper is a configured value that is the same for all hashed passwords, and is added to the password (and salt) before it is hashed. It is kept secret, and effectively turns the hash function into a secret hash function. Its merit can be argued because if an attacker is able to compromise your hashed password database, they could possibly have compromised your configuration and discovered the pepper too. However, it does add an extra hurdle for an attacker.

Re: Hackers raid eBay in historic breach, access 145 million records

#73

Post by nly »

dchest wrote: post #64
nly wrote: post #62

Earlier quoted context omitted.

> It's hard to make something usable without trusting servers in the current browser environment, even if browser vendors cooperate. That's why the solution needs to be built in to web standards like HTTP 2.x and HTML, rather than shimmed in to a javascript library. The original HTTP authentication scheme actually did one thing right, and that was bypassing HTML and Javascript (where any hope of security and privacy…

Could you give one usage example of such scheme if it was properly implemented?

Not specifically, no. Armchair solutionary ;).

Re: Hackers raid eBay in historic breach, access 145 million records

#74

Post by mnw21cam »

dchest wrote: post #29
guelo wrote: post #23

Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?

You need to know how they store passwords because ... what?

So we know how incompetent this rather large and famous company is, and how much we should trust them in the future.

Being able to point and laugh is nice too, all seriousness notwithstanding.

Re: Hackers raid eBay in historic breach, access 145 million records

#76

Post by joshu »

mkal_tsr wrote: post #40
joshu wrote: post #35

Earlier quoted context omitted.

because how the passwords are stored affects whether they are recoverable. are you dense?

He asked a simple question, what's with the hostility of asking if he's "dense" ?

It's not hostile. It's like he cannot fathom why someone might want to know the thing that they are asking.

Re: Hackers raid eBay in historic breach, access 145 million records

#77

Post by joshu »

dchest wrote: post #43
joshu wrote: post #35

Earlier quoted context omitted.

because how the passwords are stored affects whether they are recoverable. are you dense?

That's not an actionable information. There is no reason not to change password and not use different passwords for different websites even if they use yescrypt* with 2 TB ROM. *) https://password-hashing.net/candidates.html

If they were someone who used the same password everywhere, then if the password was recoverable, they need to change the password everywhere. Not the brightest password strategy but a valid question.

Re: Hackers raid eBay in historic breach, access 145 million records

#78

Post by dchest »

joshu wrote: post #76
mkal_tsr wrote: post #40

Earlier quoted context omitted.

He asked a simple question, what's with the hostility of asking if he's "dense" ?

It's not hostile. It's like he cannot fathom why someone might want to know the thing that they are asking.

Well, I'd like to know what scheme they used too, however this is only because of curiosity and my interest in this topic.

Some people seem to need (or even demand by law) to know the scheme, because they see it as a way to assess their security, however they fail to provide a satisfying answer on why exactly they need this knowledge (even when they are told to change passwords!), and how this will change their assessment.

I probably need to structure my questions like 5 Whys (https://en.wikipedia.org/wiki/5_Whys), providing the first few answers myself:

Q. We need to know the exact password hashing/encryption/storage scheme eBay used.

1. Why? - We need to know if the passwords are easily recoverable.

2. Why? - We need to assess our risks.

3. Why? - ...

Re: Hackers raid eBay in historic breach, access 145 million records

#79

Post by TTPrograms »

An idea I had a while back -

Build browser add-ons and a javascript site that performs N hashes of your master passphrase (high entropy) concatenated to the website domain (google, ebay, etc.). Set that hashed password to be your password on each website. Then when you use a computer you enter the master password and it generates all the domain-specific passwords. If that website is breached only the specific password is released. Even if someone knows you're using this scheme you can make it arbitrarily difficult for them to break it and get the master password by making N arbitrarily large.

This way you could use one master password to procedurally generate all of your passwords from any computer without relying on cloud/storage while still keeping them relatively independent. It's sort of weak to rainbow tables, but you could make N large enough and use a high enough entropy password that this would be a negligible threat I think.

Thoughts?

Re: Hackers raid eBay in historic breach, access 145 million records

#80

Post by dchest »

joshu wrote: post #77
dchest wrote: post #43

Earlier quoted context omitted.

That's not an actionable information. There is no reason not to change password and not use different passwords for different websites even if they use yescrypt* with 2 TB ROM. *) https://password-hashing.net/candidates.html

If they were someone who used the same password everywhere, then if the password was recoverable, they need to change the password everywhere. Not the brightest password strategy but a valid question.

They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing. (Remember that eBay asked users to change passwords?)

But even so, the knowledge of password storage scheme in this case is actually harmful! Suppose Alice is reusing passwords, like you said. She learns that eBay used bcrypt, and due to this knowledge thinks her password is safe, and doesn't change her password anywhere apart from eBay. Good? Nope.

Post reply on HN