Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
1–10 of 138 posts
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#2How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#3inb4 "bcrypt bcrypt bcrypt bcrypt bcrypt bcrypt bcrypt bcrypt"
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#4How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
Because it's only a website, not REAL engineering! Let the intern do it!
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#5How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
Maybe they did that right after writing it clear text in http logs stored in publicly accessible files.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#6How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
From the article it doesn't sounds like it was anything to do with the db.
Looks like they were processing the logins using GET instead of POST, unaware it was logging all the requests. Then the log files ended up on an ftp server for anyone to download.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#7How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
MD5 is not suitable either. The illusion of security is almost worse than no security.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#8How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
md5 is not really much better than plain text (I imagine a few Amazon GPU instances could crack most of the md5 hashes very quickly). bcrypt is the way forward in most cases.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#9How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
Because it's not that important. In most cases what someone could do with my account is to view articles I have paid for, either piecemeal or as a subscription. It's much more in their interest than my interest to keep that private.
They've sent me my cleartext password several times before I finally wrote it down in a place I could keep it safe, and I was always thankful.
Also, the default password is something very simple per account. I don't want to go into any more detail on that.
Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords
#10How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
> know how to md5 passwords
MD5 is an utterly terrible password hash. It's just about as bad as plaintext. If you're hashing passwords with md5, please fix it and use one of scrypt, bcrypt or PBKDF2 (recommendations are generally in that order) with an acceptable load factor[0]. Go look up mozilla's coding security guide to know how to migrate from a terrible and insecure hash to a secure password hash.
[0] the usual suggestion is that hashing a password should take a few hundred milliseconds on the production hardware, ideally at least half a second and really as much as your users will accept. For scrypt's memory load factor, it should take as much as you can spare.