Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

ieeelog.com

Post reply on HN
Print view View original

101–110 of 138 posts

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#101

Post by kanzure »

shanemhansen wrote: post #95
runn1ng wrote: post #86

Earlier quoted context omitted.

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

Unfortunately you do have to pay some money. Godaddy offers certs for 12.00 USD a year, which is probably less than you're paying to host the site. As for making it https, (hypothetical web developer) most cheap hosting providers actually provide tools for managing certs and apache configs in cpanel. It's not too difficult to do yourself. Basically install mod_ssl and copy paste a standard config, substituting the pa…

> Unfortunately you do have to pay some money. Godaddy offers certs for 12.00 USD a year, which is probably less than you're paying to host the site.

Wtf guys? Didn't we /just/ do this about GoDaddy? Just say NoDaddy.

free certs: https://cert.startcom.org/ or https://www.startssl.com/

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#102

Post by nostromo »

runn1ng wrote: post #86
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

A simple way to side-step the issue entirely is to use an OAuth provider you trust.

If you'll allow me to shamelessly self-promote. We make it really easy to do this correctly using an email and password at my startup: https://www.dailycred.com/

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#103

Post by krzysz00 »

runn1ng wrote: post #86
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

If it's for your own development work, Debian/Ubuntu will generate a self-signed SSL certificate when you install the package `ssl-cert`.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#104

Post by tlrobinson »

runn1ng wrote: post #86
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

If you don't want to worry about buying certificates and configuring webservers for HTTPS, check out CloudFlare. It's a bit expensive ($20/month for the first site, $5/month for additional sites) if all you care about is SSL, but they offer a lot more than just SSL:

http://www.cloudflare.com/

http://blog.cloudflare.com/easiest-ssl-ever-now-included-aut...

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#106

Post by sk5t »

ghshephard wrote: post #71
masklinn wrote: post #68

Earlier quoted context omitted.

> One of these days we will shut down the "Salting password hashes is a useful thing to do." Uh? Why? It is a useful thing to do. More than that, it is necessary (but not sufficient). There's a reason why all of pbkdf2, bcrypt and scrypt generate salts if you leave them to their own devices. > See: http://codahale.com/how-to-safely-store-a-password/ for details. You completely misunderstand the article.

It's implicitly understood by everyone who cares about this topic that salting is intrinsic to KDFs. I.E. by the time you've read through, and understood http://codahale.com/how-to-safely-store-a-password/ , you understand why "salting" your password gains you nothing, because rainbow tables are no longer particularly relevant to cracking passwords. And yes, while there is salting inherent to KDFs, that's not the maj…

Negative on that. Not all algorithms produce the salt internally like bcrypt does--programmers must still be careful to supply a sufficiently lengthy random salt as input to PBKDF2, for example. Labeling folks who know this as stuck in the past or ignorant is a mistake.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#107

Post by rdzgtdsv »

pjscott wrote: post #83
Pyroshock wrote: post #61

Earlier quoted context omitted.

There's a reason key derivation functions like PBKDF2 and bcrypt still require a salt as an input.

And there's a reason why high-level libraries like bcrypt handle salt generation and storage internally: if they didn't, people would screw it up. It's amazing how many people blithely use some crazy scheme like pwhash = md5("this is my salt" + password) Progress in password hashing security is primarily progress in making things trivially foolproof and then hectoring people into using them.

Doesn't this crazy scheme protect against brute force when only database is leaked, and "this is my salt" remains secret?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#108

Post by bigiain »

runn1ng wrote: post #86
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

OK, please educate me. (Take me as a model restauranteur.)

I occasionally quickly cook meals in my kitchen. I never figured out what I should do exactly to set up the dishwasher with detergent, without needing to pay for the detergent.

I just have a simple kitchen and I don't really understand dishwashing. How should I make it "hygienic"?

(That guy would get shut down by the health authorities as soon as he started serving food to the public. Why aren't web developers offering their systems to the public held to basic data safety practices?)

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#109

Post by bigiain »

runn1ng wrote: post #86
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

And, upon re-reading my other answer and noticing it came out far snarkier on screen than it did in my head… Sorry 'bout that…

http://www.startssl.com/ will give you a free SSL cert.

They've got a "How to install" section that specifically deals with Apache (and another one which deals with WHM/cPanel if you're using that for your LAMP management).

It's less than an afternoon's work to get up to speed.

Note that you'll need a dedicated ip address (or you might settle for a server running new enough versions of Apache to use SNI - http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI - but that'll still not work for IE6 and very old versions of other browsers - pre 2.0 for Firefox)

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#110

Post by PhantomLobe »

runn1ng wrote: post #86
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

https://www.startssl.com/ There you get free certificates, along with other instructions given, you're free to go.
Post reply on HN