71–80 of 110 posts
Why the ":s"? Are they supposed to offer it for free? Jokes aside, this, hopefully followed by a (class-action?) lawsuit, is the only way that the companies will learn how to properly store user data. The engineers have been talking about "best practices" for a very long time, but it appears managers only understand the language of money.
Worth more than $1000, wouldn't you think? Or perhaps Ebay will buy it regardless of the price, in hopes of quashing this?
Earlier quoted context omitted.
eBay didn't say what kind of encryption they had, only that they were encrypted. Personally I'm more concerned about the personal information in the leaked data that wasn't protected at all! So sure, change your password, but it won't change the fact that someone got your name, email address, physical address, phone number, and date of birth.
sp332 to be honest here, I am pretty sure if you search your real life name on the internet you will definitely find somewhere that you can buy the information you just mentioned. I am not trying to be mean here, I am just trying to let you know in case you didn't know. Plus you already have your email publicly displayed here ... and i found some weird stuff about amateur ... xxx movies when i googled you T_T
Also, you're an idiot.
Slightly racist observation about the sample data: there is surprisingly large amount of Asian-sounding and Middle-East-sounding names there. Not sure how the data was chosen, but I would expect more... white-sounding names.
None of the sample e-mail addresses contains "ebay", as in "example+ebay@gmail.com". I just thought that was interesting.
Earlier quoted context omitted.
Looks to me like the $ signs are acting as delimiters, and that that hash is made up of: cipher/hash: pbkdf2_sha256 cost factor: 12000 salt: zhMKabMgayvK hash: iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= This exact technique (pretty much) is described here: http://exyr.org/2011/hashing-passwords/ . It's a decent, secure way to hash passwords. Cost factor of 12000 seems solid to me (depends on the hardware they're ru…
Let's do the math: A PBKDF2 cost factor/iteration count of 12000 and 32-byte output means each candidate passphrase costs 12002 SHA256 blocks. I can buy a crappy bitcoin miner which will do 2GH/s for about USD19. Let's say we're going to use the Gawker leak as our dictionary. That's ~200,000 candidate passwords. For a given user, I can therefore find their password (if it exists in the Gawker set) in 12002 * 200000 =…
1.453 bitcoin. Reference to the fall of Constantinople, or patternicity at work?
"It is sometimes cited as the notional end of the Middle Ages by historians..."
Earlier quoted context omitted.
I am not an expert by any means, but I believe pbkdf2 is a recommended key stretching function for a hashing method (which looks to be sha256). http://en.wikipedia.org/wiki/PBKDF2 I think cracking difficulty depends on how many "iterations" they use though.
The iterations are listed as 12000. This value is supposed to double every two years and is around 128k I believe currently.
One person estimated an 8-GPU cracking machine two years ago at about 539 billion hashes per minute. At 128k hashes for one password, you could make about 70,182 attempts per second.
But here[1] is a five-machine cluster from a year and a half ago with 25 GPUs. Its speed? 63 billion per second against SHA1. This results in 492,187 attempts per second. Assuming SHA256 is about 50% slower, this would be around 246,093 per second.
Some password dictionaries contain millions of words. But if your password is '0Password', it'll probably be cracked in a couple of seconds on modern hardware.
[1] http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...