Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gab Has Been Breached

troyhunt.com

Post reply on HN
Print view View original

111–120 of 194 posts

Re: Gab Has Been Breached

#111

Post by chroem- »

roenxi wrote: post #100

Troy has a fair take. Ultimately the Gab breach is interesting, good material for an analysis like this one, and won't matter particularly in the future. At a guess, the people on Gab are there because they feel like they are under sustained political attack. This breach will be interpreted as further evidence that they are under sustained political attack. It won't make anyone behave differently - although I hope Ga…

> the people on Gab are there because they feel like they are under sustained political attack

I mean aren't they? I don't see another intellectually honest way of framing this. And yes, I'm aware: Popper's paradox, fighting fascism, etc., etc.

Re: Gab Has Been Breached

#112

Post by fastball »

walrus01 wrote: post #47
steve_adams_86 wrote: post #26

Earlier quoted context omitted.

Perhaps ironically his comments strike me as those of someone mentally ill. They make me feel sorry for him.

It's a severe disservice to non-bigoted, non-toxic people who struggle with a myriad of mental health issues to reduce a description of that specific person to "he must be mentally ill". Though undoubtedly it's entirely possible to be a cancerous individual and also have mental health issues simultaneously.

Mental health issues are not some sort of binary switch that you can clearly distinguish.

Mental health issues are just mental patterns that fall outside the bounds of what we've decided to call "normal".

Torba definitely qualifies imo.

Re: Gab Has Been Breached

#113

Post by fastball »

kkielhofner wrote: post #98
walrus01 wrote: post #47

Earlier quoted context omitted.

It's a severe disservice to non-bigoted, non-toxic people who struggle with a myriad of mental health issues to reduce a description of that specific person to "he must be mentally ill". Though undoubtedly it's entirely possible to be a cancerous individual and also have mental health issues simultaneously.

One of the wisest things I ever heard from a mental health professional: "There's a normal range of asshole, beyond that, it's mental illness" There is an entire range of diagnosable mental illnesses, below that there are entire clusters of personality disorders that don't quite raise to the diagnosis of the others. When it comes to personality disorders, especially, the current consensus of the psychiatric community…

Also worth pointing out that the diagnoses are just things we made up.

Re: Gab Has Been Breached

#114

Post by lultimouomo »

tsimionescu wrote: post #88
camjohnson26 wrote: post #59

Earlier quoted context omitted.

I thought bcrypt had built in salts, how was he able to reverse those hashes for simple passwords? Any better algorithm to use or recommendation on salting?

The salts are typically stored together with the data, as is the case here. So, if you want to see if the first password is 'password', you salt it with the first salt and hash it with bcrypt. If the result matches, you know with a huge degree of confidence[0] that indeed the first password was 'password'. You can easily do this for the entire dataset, and for a few more common passwords. [0] of course, there is a ch…

> [0] of course, there is a chance that you just discovered a hash collision, but that is exceedingly unlikely. It also means that Gab would have accepted 'password' as the password for that user anyway, even if the string they typed in was 'warblerer' (which it would also accept).

I don't think password policy enforcement can be reasonably done after the hashing. You cannot apply password rules as information about length and specific characters is lost; applying a blacklist would also be exceedingly expensive as you'd need to hash each word in your list with the selected salt.

Re: Gab Has Been Breached

#115

Post by juicyjuicytemp »

gfosco wrote: post #89
juicyjuicytemp wrote: post #67

Some bit of gossip about the CTO of Gab, seeing as how I've got a bit of context. (Throwaway, for obvious reasons.) The CTO was never a software engineer. They were a developer advocate so had some interaction with code, but was more of a "talk to developers using things and make sure the requirements were passed along to the dev team" sort of guy, rather than someone that knew his technical details (beyond say, the…

You know pretty much nothing about me, unsurprisingly. I certainly don't need your pity, lol, this last year has been one of the best.

For what it's worth, I'm not actually surprised you left Facebook when you did. A solid half year of covid meant that you stopped having to interact with folks, in person, that might've reminded you what real people that disagree with you are like, rather than just the caricatures.

If you actually think you're as good as you are, I'd dare you to do the "talk to someone that thinks differently than you". I wouldn't be surprised if you'd learn a thing or two. :)

Re: Gab Has Been Breached

#116

Post by bawolff »

camjohnson26 wrote: post #59
dt3ft wrote: post #46

If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrized queries. [1] https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...

I thought bcrypt had built in salts, how was he able to reverse those hashes for simple passwords? Any better algorithm to use or recommendation on salting?

Some people like to add "pepper" in addition to salt. Salt would be a unique value that's combined with each password. Pepper is a global secret combined with the unique salt, that is not stored near the passwords (e.g. stored in a config file). The idea being in an sql injection, you can typically dump the entire db but not config files or anything else. Of course if they totally take over your server you are still just as screwed, and if you have sql injections you likely have other vulns too.

https://en.m.wikipedia.org/wiki/Pepper_(cryptography)

Re: Gab Has Been Breached

#117

Post by TeMPOraL »

shinsheel wrote: post #77
minimaxir wrote: post #39

Earlier quoted context omitted.

HN thread from 2016 on Torba getting booted: https://news.ycombinator.com/item?id=12934388 Includes comments from Sam Altman and Torba, posting as rvcamo

I really hate how Sam didn't respond on the first objection about double standards when other founders openly sexually harassed women on the streets and got nothing for that. Like...what, commentator just made it all up and nobody noticed? Or it actually happened and Sam doesn't have even the minimal plausible excuse?

On a surface read, the author of the second objection may have not realized that prank videos are made with actors, not unsuspecting strangers.

Re: Gab Has Been Breached

#118

Post by bawolff »

refurb wrote: post #108
dillondoyle wrote: post #31

Earlier quoted context omitted.

The stuff he is tweeting from the official Gab twitter is truly hellishly insane ! "As per my policy of not communicating with non-Christian and/or communist journos, I will not be replying to this non-story. " https://twitter.com/getongab/status/1366954798524887042

Maybe I'm missing some context, but what about that Tweet was disgusting versus just trashy or in poor taste? Compared to some of the crap on Twitter it's pretty tame.

The word disgusting literally means to be in extremely poor taste (e.g. "the rotton food i ate was disgusting")

Re: Gab Has Been Breached

#119

Post by Clewza313 »

HNfriend234 wrote: post #25

I use gab quite frequently but mainly for the memes and jokes. The vast majority of people on there use pseudonymous aliases anyways so no one cares if the site gets hacked. People on the right-wing have also been subject to extensive persecution (harassment, doxing etc.) from the left-wing so we're all quite used to it by now. I'm been trying to teach as many people as possible about how to stay anonymous online, ho…

They're not pseudonymous anymore if their email addresses got leaked, which seems to have happened.

Re: Gab Has Been Breached

#120

Post by gfosco »

juicyjuicytemp wrote: post #115
gfosco wrote: post #89

Earlier quoted context omitted.

You know pretty much nothing about me, unsurprisingly. I certainly don't need your pity, lol, this last year has been one of the best.

For what it's worth, I'm not actually surprised you left Facebook when you did. A solid half year of covid meant that you stopped having to interact with folks, in person, that might've reminded you what real people that disagree with you are like, rather than just the caricatures. If you actually think you're as good as you are, I'd dare you to do the "talk to someone that thinks differently than you". I wouldn't be…

It's odd to me that you think I've insulated myself with only people that think like me. It's like you don't know me at all. I'm literally the person who reached out and had 60 different meetings with all sorts there, and continued to maintain bipartisan group chats. Try to realize that you appear to be the one who thinks I'm a caricature.
Post reply on HN