It would really make me laugh if Disney was at fault but it sounds like people with compromised credentials reusing those same creds.
How do you know of your credentials are compromised?
Disney+ fans without answers after thousands hacked
11–20 of 88 posts
Re: Disney+ fans without answers after thousands hacked
#12They can still torrent the content, which is what I'm doing after I paid for the first month of Disney+ and then found out their DRM disallowed Linux because of "security levels".
Re: Disney+ fans without answers after thousands hacked
#13It would really make me laugh if Disney was at fault but it sounds like people with compromised credentials reusing those same creds.
At this point if they're rolling out a massive service without strong authentication controls and 2FA then it is their fault.
Re: Disney+ fans without answers after thousands hacked
#14Earlier quoted context omitted.
Sounds like JSON web tokens! Should have stuck to sessions if that's the case. Admittedly, the performance benefits of jwt are probably warranted here. But still, you either end up building an in-memory blacklist or a DB table thus negating most benefits.
It's not that hard to build a highly available active-active session service given time and engineering headcount. It's hard if you're trying to get out the door fast, though.
Yea I'm not saying it's impossible. But I'm saying it's probably easier to just make traditional cookies/sessions scale.
I went through my shiny jwt phase. I'm happily back in session land though.
Re: Disney+ fans without answers after thousands hacked
#15It would really make me laugh if Disney was at fault but it sounds like people with compromised credentials reusing those same creds.
How do you know of your credentials are compromised?
Probably the best way to check is https://haveibeenpwned.com/
Re: Disney+ fans without answers after thousands hacked
#16Laughing at some of this reporting.
> More than 4,000 customer accounts appeared in the search
To clear this up:
No, not true. The software in the screenshot called Open Bullet and it's basically a request builder for Selenium (ok it's more than that but you get the idea). You add in lists of usernames/passwords (from database dumps) and it runs your script. You have success/fail reporting, and that's where you get "Hits: 4"
> Ads on the dark web for stolen Disney+ accounts
That's a sellers page from shoppy.gg — not the dark web.
Re: Disney+ fans without answers after thousands hacked
#17Why are Disney+ customers referred to as “fans”?
Re: Disney+ fans without answers after thousands hacked
#18OP you can do better with that title. We all know it wasn’t “hacked”.
Re: Disney+ fans without answers after thousands hacked
#19I am sure Netflix and amazon prime users also reuse their passwords, but I haven’t yet heard about users having the Disney+ issues with these accounts.
From the article: The streaming service does not have two-factor authentication.
Yeah, I've logged into my Amazon account on my phone before and it wouldn't let me in until I verified something via email. The lack of these security controls is negligent these days. I can't totally blame Disney though, since the opportunity cost of implementing this level of security just isn't worth it. The public doesn't really care enough, and governments don't seem to care about security at all.
Re: Disney+ fans without answers after thousands hacked
#20yikes. It doesn't support the security feature of logging everyone out of the account? So if a someone gets access to your account they're in for good.
Sounds like JSON web tokens! Should have stuck to sessions if that's the case. Admittedly, the performance benefits of jwt are probably warranted here. But still, you either end up building an in-memory blacklist or a DB table thus negating most benefits.
I often tend to just use relatively short lived tokens (12 hrs mostly), which avoids a lot of issues in practice. It depends on the use case. Depending on their DB systems and caching infrastructure, the JTI in as a key in a revocation database would work. It's not always worth implementing though.