Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Knuddels: Chat platform must pay after hacker attack fine

tellerreport.com

Post reply on HN
Print view View original

101–110 of 125 posts

Re: Knuddels: Chat platform must pay after hacker attack fine

#101

Post by Arnt »

onion2k wrote: post #97
Arnt wrote: post #36

Earlier quoted context omitted.

No. I've implemented precisely that and it doesn't prove what you think. What you do is have one single function create the user, pick a random password, set it in the database (which in my case uses a perfectly sensible hash) and send the user email. The cleartext password in the mail comes from the function's local string variable, not from the database. Whether doing this is a good idea is another question. IMO it…

How often do you purge your mailserver's logs (or if you use a mail API, how often do they purge their logs)? If it's "Never, I didn't think of that." then all your user's inital passwords are sitting there for the taking. Of course, you may have a system that forces a password reset on login. That won't help the users who have never logged in. Those accounts are freely available to a hacker. Plaintext passwords anyw…

You make it sound as if most mail servers log message contents. None of the servers I've used in the past 25 years did that (sendmail 5 on ultrix, later smail 3, then zmailer, then postfix).

The recipients' servers store the message with the password, of course, but they also store the other messages the same user has received from the same server, which in my case contain the same information as what could be accessed with the password. So the password offers very little additional value to an attacker, compared to just reading the mail.

Re: Knuddels: Chat platform must pay after hacker attack fine

#102

Post by Someone »

donaltroddyn wrote: post #64
Drakim wrote: post #46

Earlier quoted context omitted.

It's possible to do that without storing the passwords in plain text though! Run each word of the chat though the same hash+salt mechanism and compare to what you have stored.

Assuming they're using a suitable hashing algorithm for passwords (ie, Argon2, bcrypt, scrypt, PBKDF2), this approach would be prohibitively expensive, especially for a chat platform, with presumably lots of messages. Also, you probably can't just try hashing each word, since there could be whitespace and punctuation in the password text, so I think you'd have to hash all possible substrings of each message to be abl…

Store the length L of the password, its salted hash H, and its bytes, XOR-ed, X.

For every message typed, compute a running XOR of each sequence of L bytes (2 XOR’s per character, so as good as free). Whenever it equals X (about once every 64 letters or so, because typical text doesn’t use all bits in each byte equally), compute the salted hash of the last L characters, and compare with H.

Unicode and Unicode normalization will complicate that, but I think it should be fast enough for a chat.

You probably can also improve on that factor 32 by storing multiple XOR-like (but slightly more computationally expensive) hashes and computing multiple running totals.

Given that this is to protect users from falling for scammers who claim they need their password to help them, you may be able to run it on the user’s machine.

I fear, however, that a scammer will just ask them to type their password with a space inserted, spell it in the NATO spelling alphabet, or whatever. If you fall for a scammer, that won’t stop you from giving them your password.

Re: Knuddels: Chat platform must pay after hacker attack fine

#103

Post by buboard »

hnaj wrote: post #42

According to the link: https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... They were doing this so they could filter out the passwords from chats (i.e. to make it so users can't give out their passwords to other users). Not saying this justifies it, but it's interesting.

What if this is part of someone's policy, with the knowledge of users of course? For example an app for the technically illiterate or for small children?

Re: Knuddels: Chat platform must pay after hacker attack fine

#104

Post by buboard »

amelius wrote: post #48
Double_a_92 wrote: post #40

Earlier quoted context omitted.

The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...

So they tried to improve security, but instead they weakened it.

They might also have prevented a lot of users from being hacked. We can't know for sure.

Re: Knuddels: Chat platform must pay after hacker attack fine

#105

Post by buboard »

arayh wrote: post #85
Double_a_92 wrote: post #40

Earlier quoted context omitted.

The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...

This sounds dumb. So if my password was "something" (yes, it's a terrible password), it would just keep censoring that word every time I write that into the chat?

sounds smart. not only you prevent users from giving their passwords, you force them to choose better passwords.

Re: Knuddels: Chat platform must pay after hacker attack fine

#106

Post by megaremote »

Double_a_92 wrote: post #40
tyingq wrote: post #15

"Knuddels is safer than ever." Corporate speak is just so funny. The bar for "safer than ever" is pretty low when your dev team hasn't heard of password hashing.

The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...

So, there is no way at all to stop that from happening.

Re: Knuddels: Chat platform must pay after hacker attack fine

#107

Post by megaremote »

_8j50 wrote: post #90
Double_a_92 wrote: post #40

Earlier quoted context omitted.

The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...

Why didn't they just hash all the words they type if you must(maybe bloom filter?)

But if you use different hash keys, then you would have to hash each word multiple times.

Re: Knuddels: Chat platform must pay after hacker attack fine

#108

Post by donaltroddyn »

Someone wrote: post #102
donaltroddyn wrote: post #64

Earlier quoted context omitted.

Assuming they're using a suitable hashing algorithm for passwords (ie, Argon2, bcrypt, scrypt, PBKDF2), this approach would be prohibitively expensive, especially for a chat platform, with presumably lots of messages. Also, you probably can't just try hashing each word, since there could be whitespace and punctuation in the password text, so I think you'd have to hash all possible substrings of each message to be abl…

Store the length L of the password, its salted hash H, and its bytes, XOR-ed, X. For every message typed, compute a running XOR of each sequence of L bytes (2 XOR’s per character, so as good as free). Whenever it equals X (about once every 64 letters or so, because typical text doesn’t use all bits in each byte equally), compute the salted hash of the last L characters, and compare with H. Unicode and Unicode normali…

I did think of similar approaches, but anything I could think of that helps you to quickly determine if a given string contains the password also helps an attacker if the passwords and salts are compromised.

In the suggested case, storing the length of the password alone massively reduces the search space, and storing the XOR (of the plaintext with the hash, I think you're suggesting?) negates the value of using a hashing algorithm suitable for passwords, since the point is that checking if a password matches a hash is an expensive operation.

Re: Knuddels: Chat platform must pay after hacker attack fine

#109

Post by AnthonyMouse »

rocqua wrote: post #78
johannes1234321 wrote: post #61

Earlier quoted context omitted.

Even the threat of death penalty doesn't stop crimes. True, if there is no punishment and a threat is teethless nobody acts on it (that's why the big GDPR outcry also came only this year after the two year introductory phase) However if you have too high fines what happens s that companies try everything to hide the fault and lie to avoid the fines. Here a company complied to all things, improved security (which acco…

There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. Some examples of economic crime would be: not implementing security, tax fraud, overweight freight trucks; speeding to make a delivery on time (whilst on the clock). The first kind of crime is generally made by people who 'know they are wrong, but they feel like they don't…

> There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'.

The relationship is the opposite of the one you're describing.

The problem with personal crimes is that everyone has a different utility function. If you could steal a million dollars at risk of a month in jail, many people would take the risk. Fewer at six months in jail. Fewer still at a year. Fewer still at five years. So you need as high a penalty as you can get without violating proportionality (or reaching the point of diminishing returns, once nearly everyone who can be is deterred).

There are some people who aren't even deterred by the death penalty, e.g. because they'd rather have the money needed to save their kid's life even if it costs them their own, but that's pretty rare. Most of the people who aren't deterred by even large penalties are simply the people who don't expect to be caught, or don't realize they were violating of the law to begin with.

By contrast, for economic crimes, nearly everyone's utility function is the same. If you can save $2000 by taking a 50% risk of having to pay the $2000 anyway plus a $1500 fine, it's profitable. If you can save $2000 by taking a 50% risk of paying the $2000 anyway plus a $2500 fine, it isn't. A $3000 fine provides no additional deterrence, and anything more is just a money grab. Even the $1500 fine may be higher than strictly necessary, because getting fined at all results in a PR hit that independently provides a non-zero deterrence value.

That isn't to say that a small fine won't leave a large number of violators, but they're no longer the people overtly doing the calculations. They're the people who assign negligible probability to getting caught, or who don't even realize they're violating the law. No amount of higher penalties will deter them, the only thing that works against that group is vigorous enforcement -- which works fine (better even) with modest penalties, because all you really need to do to get those groups into compliance is to tap them on the shoulder and explain how they're not.

Re: Knuddels: Chat platform must pay after hacker attack fine

#110

Post by AnthonyMouse »

pbhjpbhj wrote: post #92
AnthonyMouse wrote: post #76

Earlier quoted context omitted.

> If you could skip your tax bill for a few years, but get a much smaller fine if you cooperated when caught then you'd be silly to actually pay. If you do the work ahead of time, you pay the cost of doing the work. If you wait for the fine, you pay the cost of doing the work plus the fine. It doesn't take a lot of fine to make doing the work to begin with worth it -- basically just accounting for chance of getting a…

Maybe, but there's much more work that needs doing to secure PII than just not having plaintext passwords. So, they can seemingly avoid doing all that work too, and maintaining those systems (with staffing costs). And you get a leg-up over the competition who can't use the cash that they put in to security. That means those with poor security regimes may "win" because the costs of poor PII hygiene are externalised. I…

> Maybe, but there's much more work that needs doing to secure PII than just not having plaintext passwords. So, they can seemingly avoid doing all that work too, and maintaining those systems (with staffing costs).

If the regulators catch someone breaking a rule like this, the consequence should obviously involve an audit that looks for other violations and requires them to fix those too.

But even if it didn't, your conclusion wouldn't follow, because they would still have no incentive to fix the other problems unless they expected to get caught for not fixing them. But if they did expect to get caught then the numerous predicted small fines would be a sufficient deterrent.

> It would certainly be nice to imagine all the 2 million UK corporations are addressing PII security rather than hiding and hoping not to get a fine

It's the hiding and hoping not to get a fine that's the reason large fines don't work. Higher penalties can't deter someone who doesn't expect to be caught.

What works is smaller penalties with vigorous enforcement.

Post reply on HN