Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quora User Data Compromised

blog.quora.com

Post reply on HN
Print view View original

101–110 of 525 posts

Re: Quora User Data Compromised

#101

Post by larkeith »

diego wrote: post #69
s3r3nity wrote: post #19

So I'm not a security expert, so I ask this in real earnest to learn: what is it that these companies keep doing wrong, and/or why aren't they adjusting to the climate that these types of attacks are increasing over time? Or are they trying to adjust, and the attacks are getting so sophisticated that the pace of investment in counter-measures is below that of the pace of advancement in the complexity of attacks? Or s…

In this particular case it doesn't seem too bad. Someone's name and address are not (or should not be) particularly sensitive information. Passwords are, and that's why best practices only keep a one-way function of the password ("encrypted" implies that it can be decrypted to plaintext, which should not be the case). Luckily you can sign up for Quora with any name and email. You have to assume that no matter how har…

For anyone who missed it in Quora's post, passwords were salted and hashed, which makes it functionally impossible to decrypt en-masse. Targeted attacks (trying to discover a specific user's password) may or may not be feasible, depending on if the salts were retrieved, how many iterations and which hashing algorithm was used, and the processing power available to the attacker.

Re: Quora User Data Compromised

#103

Post by mehrdadn »

jedberg wrote: post #91
jacquesm wrote: post #78

This is why I hate companies that force you to sign up to gain access to content. I do not want that relationship. Sooner or later those systems will be legacy and then maintaining them will be a pain. Bitrot will set in and sooner or later there will be a breach. One new development is that you used to be able to get your invoices mailed via snail mail. Then that disappeared and you got your invoices mailed via emai…

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too. For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. A…

You could just use a normal Citi or BoA or any other card that generates virtual card numbers and that'll also lock it to that vendor after the first charge. So that they couldn't even hit it for $0.80 if they wanted to.

Re: Quora User Data Compromised

#104

Post by jjoonathan »

jedberg wrote: post #91
jacquesm wrote: post #78

This is why I hate companies that force you to sign up to gain access to content. I do not want that relationship. Sooner or later those systems will be legacy and then maintaining them will be a pain. Bitrot will set in and sooner or later there will be a breach. One new development is that you used to be able to get your invoices mailed via snail mail. Then that disappeared and you got your invoices mailed via emai…

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too. For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. A…

Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu item disappeared, bringing clicks-to-login from 1 to ~10.

A few weeks ago I saw bitwarden finish their third party security audit and took the opportunity to jump. Couldn't be happier. Autofill fails less, the "copy password" menu works, the mobile experience isn't intentionally broken to sell an app, and export->import went without a hitch. Better, actually: it is the first time I have done an export/import and had the resulting data immediately work better in the second app. There's also the hope-springs-eternal factor of bitwarden giving me the option to host the sensitive stuff myself once I get off my butt and set up that server I've been meaning to for a while now.

If you're thinking about lastpass, save yourself the trouble and try bitwarden first. Or something else, but bitwarden has been good to me and lastpass, well, hasn't, to put it politely :)

Re: Quora User Data Compromised

#105

Post by Bucephalus355 »

One thing I would like to do is have various US Senators send letters to the major corporations, and perhaps even large open source groups (like npm), and ask them, proactively, what they are doing to secure citizens around the world's data.

There is something called the Cybersecurity Bipartisan Caucus in the US Senate.

I have found calling these senators (which I have never done before for any politician about anything) extraordinarily helpful and gratifying. I have even explained that I don't live in their state, and yet they still listen and clearly need the advice from good security/sysadmin people (like asking them why Facebook still doesn't have a CSP Security Header).

It was only 6 days ago that the "International Committee on Privacy", made up of Senators from countries around the globe, met in London to question Richard Allan, VP of Privacy at Facebook. Mark Zuckerberg rejected the request for his attendance.

[1] https://www.warner.senate.gov/public/index.cfm/cybersecurity

[2] https://www.parliament.uk/business/committees/committees-a-z...

[3] https://www.youtube.com/watch?v=1P97ubLDbJI

Re: Quora User Data Compromised

#106

Post by ynniv »

jacquesm wrote: post #83
IshKebab wrote: post #76

Earlier quoted context omitted.

They don't mention the hash function anywhere so I'm assuming MD5.

If they don't mention it you could assume any one of the commonly used hash functions.

Sure, but if youre using a good one you usually say what it is. "Salted and hashed" is usually MD5 or SHA1, both of which provide almost no deterrence to brute forcing.

Re: Quora User Data Compromised

#108

Post by throwaway292939 »

I feel that this is becoming a standard narrative. SV company comes up with an idea, decides harvesting lots of user data is how they will monetize. VCs pump in a lot of money and expect their returns, so company is now forced to collect even more data aggressively (the sign-in wall that many others have pointed out is an example of this). VC pressure causes company to "innovate" fast, most likely trading off security for new features in the meantime. As this progresses and they become more valuable, they are then targeted by hackers, which causes some type of compromise of users' data.

Quora is an intimate medium — tied to real names, real and often deep interests. It's especially bad that this happened.

There needs to be a better way to realign incentives in this ecosystem, otherwise this story will repeat.

Post reply on HN