Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

43M passwords hacked in Last.fm breach

techcrunch.com

Post reply on HN
Print view View original

101–110 of 172 posts

Re: 43M passwords hacked in Last.fm breach

#101

Post by andybak »

zer0gravity wrote: post #92
toyg wrote: post #91

Earlier quoted context omitted.

... Until the openid provider is breached, like LinkedIn was. Then you get access to everything for everyone . Decentralized schemes are safer overall. Ideally you want something like what LastPass does: local credentials replicated on the network in encrypted form. This way you take away responsibility for safe storage from unreliable websites, but you don't place the whole burden on the user (as the data is replica…

> What I want, is host my own security agent I don't trust third parties, no matter who they are. Technology can be developed so that the burden on the user is reduced, but nodoby wants to go there, because after all companies do want to have as many data about the user as they can...

I don't trust 3rd parties but I do evaluate the threat that comes directly from large companies to be lower than the threat that comes from criminal hackers.

Re: 43M passwords hacked in Last.fm breach

#102

Post by ntlve »

matt_wulfeck wrote: post #22

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for impor…

Not made by the websites themselves but I think dashlane does something close to what you are asking for: https://www.dashlane.com/passwordchanger

Re: 43M passwords hacked in Last.fm breach

#103

Post by throwawayReply »

jcrites wrote: post #77
grrowl wrote: post #60

Earlier quoted context omitted.

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for…

This has some advantages but there are negatives too. Do I really want Google or Facebook to get a notification every single time I log in to a service because they get an email with a "magic link"?

Google / Facebook already know enough about services used, do we really want to transfer even more information their way?

Also, another trouble with this is the loss of anonymity.

There are very few places to register an email address without an SMS number. There are few places to get an SMS without a real name and address.

Yes, I'm sure there are places to get these things for someone willing to put in a lot of effort, but for everyone else, their email provider has their SMS, their SMS provider has their name and address.

So by requiring email as authentication, essentially every online identity comes back to your real name and address through a small number of hops.

It used to be possible to spin up a TOR session and interact with real services you would otherwise use. Between the crunch on anonymous email and cloudflare's endless captchas, TOR is increasingly useless for interacting with normal services.

This is a feature, not a bug. Unfortunately it turns out that many people are abusive when anonymous and use that to their advantage so anonymity has been curbed to keep control over that problem.

Re: 43M passwords hacked in Last.fm breach

#104

Post by massysett »

dogma1138 wrote: post #21
StavrosK wrote: post #20

It looks like our current approach isn't working. What if we had each site publish its login/registration endpoints in a URL, e.g. .well-known/loginurls? Then the password manager could detect you're trying to register or log in and log you in itself, generating your password in the process. Why aren't logins machine-accessible yet?

Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.

A lot of my password usage now is for apps, not web. I still know of no good way to do this with a password manager other than lots of copying and pasting, which is even more cumbersome on a phone than on a PC. I favor the apps that allow me to use TouchID.

Re: 43M passwords hacked in Last.fm breach

#105

Post by flushandforget »

camtarn wrote: post #90
grrowl wrote: post #60

Earlier quoted context omitted.

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

It's worth pointing out that in this particular case, some people will have created their Last.fm accounts more or less solely for use with Audioscrobbler, a protocol which allows them to track music listens through various third-party music players. The important bit about that is that the Last.fm/Audioscrobbler account credentials get typed directly into the third-party players - usually there's no browser involved…

I wrote a simple web app to work with last.fm's api. A little fiddly, but in essense it worked. Somewhere buried in settings were all the apps that have access to my account. I then went back to Spotify and noticed it wanted my username and password. And ever since, I just haven't been bothered. I'd rather some throwaway autogenerated app linking passwords and authenticating consistency.

Copying and pasting links isn't that hard. Go to last.fm, generate OTP token/link, paste into Spotify. Done. I should have some easy way to identify authenticated apps under my account and kick them out, or reset all.

Not all of us use Web mail. And I might not want a link automagically opened there and then, under a browser.

Re: 43M passwords hacked in Last.fm breach

#106

Post by throwawayReply »

runesoerensen wrote: post #75
Alex3917 wrote: post #49

Earlier quoted context omitted.

With the Dropbox hack for example, the reason they got hacked is because one of their employees reused a password, presumably from another site that got hacked. So that's one vector, where every time a site gets hacked, people using weak passwords (and reusing them) create the risk of future hacks. But more generally, exposing your account credentials allows others to impersonate you and potentially scam others, expo…

Got it, I certainly disagree and don't think the 41.000.000 last.fm users (whose passwords were cracked in two hours) should receive a substantial fine. I don't think there's a whole lot of precedence for this type of legislation either; what you're suggesting requires at least two other crimes to be committed by someone else (before someone else would potentially be at risk due to the user's bad password choice) - i…

With a weak password, step 2 is redundant, even with more than the recommended rounds of bcrypt/scrypt, if your password is "123456" it's getting cracked.

verify(candidate, storedEntry) has to run in a time reasonable for a web service to handle, which means that 123456 is still going to get tried against all the accounts in a reasonable time.

Re: 43M passwords hacked in Last.fm breach

#107

Post by GolDDranks »

toomanybeersies wrote: post #42
GolDDranks wrote: post #25

Earlier quoted context omitted.

I started using LastPass just the other day because the recent news made me nervous. It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor…

I'm using lastpass and I haven't had to pay for the browser plugin. I've been using lastpass for the past year or so, and I've had no real issues with it ergonomics-wise. I can't even think of any sites off the top of my head that have given false positives. It does seem painfully slow and unresponsive sometimes though, which isn't ideal. It's slow enough to disrupt my flow more than just typing in the same password…

I could use the plugin for a trial period, but now it says that I have to be a premium member? Maybe it's because I also installed the app to my smartphone, thus my smartphone become the one device I can use the free version with?

Re: 43M passwords hacked in Last.fm breach

#108

Post by jstanley »

throwawayReply wrote: post #103
jcrites wrote: post #77

Earlier quoted context omitted.

It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for…

This has some advantages but there are negatives too. Do I really want Google or Facebook to get a notification every single time I log in to a service because they get an email with a "magic link"? Google / Facebook already know enough about services used, do we really want to transfer even more information their way? Also, another trouble with this is the loss of anonymity. There are very few places to register an…

> There are few places to get an SMS without a real name and address.

I'm building a service to solve this problem right now. It works already and I hope to make it live within the month, it just wants styling and polishing.

The idea is you sign up with just a username and password, no email address required. You pay with Bitcoin and can buy a mobile phone number, from a selection of countries, for ~$3/mo. You can then use the web interface to send and receive messages.

Email address in my profile - please get in touch if you're interested in learning more.

Re: 43M passwords hacked in Last.fm breach

#109

Post by josteink »

> it’s 2016 people — use a platform like LastPass to generate randomized, complex passwords that are unique to every service for which you sign up.

Another way to read this statement is that passwords simply doesn't work. We need something different. Something better.

And from the comments we find this:

> I am a bit confused. The article states that this happened in 2012, why is it posted today? Something happened in relation to this breach?

I think this also needs much better clarification. What has happened since 2012 which makes this newsworth now? And where is the LeakedSource report they cite but never link to? Where can I get more info?

This is very bad reporting.

Re: 43M passwords hacked in Last.fm breach

#110

Post by ryanlol »

daphinz wrote: post #70
kevin_thibedeau wrote: post #56

It would be nice if the EU would do something useful like require all sites to hash salted passwords and prohibit the use of weak hashes for new accounts. Instead we get the ridiculous cookie nag.

How would you regulate that? Wouldn't that suggest that the EU would have some sort of access to private back-ends in order to check?

... Just like you'd regulate anything else?
Post reply on HN