Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords • Hacker News Board

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#121

Post by pbhjpbhj » Wed, Sep 26, 2012, 9:05 AM UTC

masklinn wrote: post #118

pbhjpbhj wrote: post #74

Earlier quoted context omitted.

Really? 155a7a01308fa0807f722c5984bd91fb --- I find "high-end graphic card (~$500) can compute 10 billion md5 hashes per second" a bit unbelievable [but that's progress for ya]. So that's roughly all possible alphanum characters of stringlen 6, each second. So if my calculation is correct (assuming 60 alphanum chars randomly chosen) that's only 7000 years to calculate all 12 char strings? Yes I realise that md5'ed pa…

> 155a7a01308fa0807f722c5984bd91fb You may want to read the last phrase of my comment. > I find "high-end graphic card (~$500) can compute 10 billion md5 hashes per second" a bit unbelievable And yet those are the numbers oclhashcat lite publishes for 0.10 on a stock Radeon HD6990 (10886.3M c/s): http://hashcat.net/oclhashcat-lite/ > Yes I realise that md5'ed password strings aren't random Which is the whole point, a…

You're carefully excision of the end of my "a bit unbelievable" comment misrepresented what I was saying and the manner in which I was saying it:

"a bit unbelievable [but that's progress for ya]"

In case you're comprehension is masked in some way the meaning of this is "it's hard to believe that this is possible [with such stock hardware] but I recognise that technological progress has brought us to a point where this is possible; tech progress can surprise one in this sort of manner" - obviously I felt that such verbosity wasn't required.

>Just saying absolutely nothing? //

So what's the plaintext of that hash I posted?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#122

Post by pbhjpbhj » Wed, Sep 26, 2012, 9:13 AM UTC

problemdomain wrote: post #94

pbhjpbhj wrote: post #74

Earlier quoted context omitted.

Really? 155a7a01308fa0807f722c5984bd91fb --- I find "high-end graphic card (~$500) can compute 10 billion md5 hashes per second" a bit unbelievable [but that's progress for ya]. So that's roughly all possible alphanum characters of stringlen 6, each second. So if my calculation is correct (assuming 60 alphanum chars randomly chosen) that's only 7000 years to calculate all 12 char strings? Yes I realise that md5'ed pa…

You're fundamentally misunderstanding the problem domain. At the highest level, you're missing the issue of specialization and parallelization. This misunderstanding is partly alluded to by your surprise at the power of GPUs to hash passwords. GPUs can have hundreds or even thousands of what you might think of as "cores", but they're very specialized cores that are only suited to certain kinds of operations. Those op…

>"7,000 years divided by 100,000 hashes is 25.55 days." //

This only works if hash reversal costs the same as hash calculation. I think you've made an error.

Brute force in hash terms doesn't mean a "search" it means you take a string, hash it and see if the hash matches. That's the brute part, no grace.

The 7000 years figure is clearly vastly inflated what's needed for passwords in the wild but I'm merely countering the contention that 'md5 is as good as plaintext'.

I note that despite it apparently only taking seconds to reverse my short string that no one has posted the plaintext yet. This doesn't look like it is as easy to read as plaintext.

I'm not at all claiming md5 is good security - just suggesting that the claim that md5 is equivalent to plaintext is hyperbole.

The easy way to show that I'm wrong is to post the plaintext of that hash.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#123

Post by mattmanser » Wed, Sep 26, 2012, 9:30 AM UTC

nostromo wrote: post #117

geofft wrote: post #113

Earlier quoted context omitted.

That can't possibly work, right? If a user accesses my website over unsecured HTTP, gets sent to an HTTPS DailyCred (or other OAuth provider) site to log in, and back to my unsecured HTTP site, they're still as vulnerable to man-in-the-middle attacks as if the OAuth provider didn't use HTTPS. In particular, a man-in-the-middle can capture the redirect to DailyCred and instead send the user to some trojaned site to ca…

All of our inbound links and API calls from our clients are https from the get go. However, you are correct that a man-in-the-middle could rewrite the http website of someone using us to change the links to http from https and then perform a man-in-the-middle attack on that request. Because of this narrow risk, we encourage our clients to still get ssl certs as they grow. However, when they are small MVPish non-sensi…

Don't ever tell people to use OAuth as an 'alternative'

1. It's a shitty UX

2. There are more people without an OAuth provider than there are with them

3. It's a sure fire way of killing your conversions

4. It means people start getting tethered to providers

5. It's very complicated when it goes wrong

6. THIS DOESN'T SOLVE THE OP'S QUESTION AT ALL. OP POINTS IT OUT. YOU IGNORE OP.

Enabling SSL stops people sniffing sensitive data on public wifis. That's why everyone says enable SSL by default.

Also there's something wrong if you're a programmer and can't afford an SSL cert as it's the same price as a couple of beers.

I also find your password advice extremely questionable, it just doesn't make sense to me.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#124

Post by wiradikusuma » Wed, Sep 26, 2012, 10:28 AM UTC

bigiain wrote: post #109

runn1ng wrote: post #86

Earlier quoted context omitted.

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

And, upon re-reading my other answer and noticing it came out far snarkier on screen than it did in my head… Sorry 'bout that… http://www.startssl.com/ will give you a free SSL cert. They've got a "How to install" section that specifically deals with Apache (and another one which deals with WHM/cPanel if you're using that for your LAMP management). It's less than an afternoon's work to get up to speed. Note that you'…

For the sake of completion:

http://en.wikipedia.org/wiki/Server_Name_Indication#No_suppo...

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#125

Post by shiven » Wed, Sep 26, 2012, 11:12 AM UTC

geofft wrote: post #112

bigiain wrote: post #108

Earlier quoted context omitted.

OK, please educate me. (Take me as a model restauranteur.) I occasionally quickly cook meals in my kitchen. I never figured out what I should do exactly to set up the dishwasher with detergent, without needing to pay for the detergent. I just have a simple kitchen and I don't really understand dishwashing. How should I make it "hygienic"? (That guy would get shut down by the health authorities as soon as he started s…

Because most people grow up knowing how to use dishwashers, but not knowing how to use SSL. Until we get to that point, we should focus on educating and informing people instead of snarking at them and hoping they get shut down.

The OP's (parody) comment is not about using dishwashers, but rather about dishwashing without using any detergent despite knowing that detergent is to dishwashing as SSL Certs is to https ...

and FTR, I did not grow up knowing how to use dishwashers but was quite aware of the basic relationship between the act of dishwashing and detergents. Extrapolating that fundamental relationship to a dishwasher is to say the least -- elementary.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#126

Post by runn1ng » Wed, Sep 26, 2012, 1:45 PM UTC

bigiain wrote: post #109

runn1ng wrote: post #86

Earlier quoted context omitted.

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

And, upon re-reading my other answer and noticing it came out far snarkier on screen than it did in my head… Sorry 'bout that… http://www.startssl.com/ will give you a free SSL cert. They've got a "How to install" section that specifically deals with Apache (and another one which deals with WHM/cPanel if you're using that for your LAMP management). It's less than an afternoon's work to get up to speed. Note that you'…

This looks very good and easy to get it working. Will try next time, thanks!

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#127

Post by pbhjpbhj » Wed, Sep 26, 2012, 3:16 PM UTC

nnnnnnnn wrote: post #92

pbhjpbhj wrote: post #74

Earlier quoted context omitted.

Really? 155a7a01308fa0807f722c5984bd91fb --- I find "high-end graphic card (~$500) can compute 10 billion md5 hashes per second" a bit unbelievable [but that's progress for ya]. So that's roughly all possible alphanum characters of stringlen 6, each second. So if my calculation is correct (assuming 60 alphanum chars randomly chosen) that's only 7000 years to calculate all 12 char strings? Yes I realise that md5'ed pa…

masklinn was very clear about the difference between an ivory tower example (yours) and the reality of user passwords. It appears you have missed his point.

>an ivory tower example (yours) and the reality of user passwords //

So you don't think that 'md5 is only as difficult to read as plaintext is actually hyperbole'?

If this is the case then surely someone has a plaintext for the hash I wrote - how much more real can one get. It's a simple English language password.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#128

Post by runn1ng » Wed, Sep 26, 2012, 3:27 PM UTC

EvanAnderson wrote: post #88

runn1ng wrote: post #85

Earlier quoted context omitted.

If you want to have a shared folder that you share between people you trust, it's still the simplest solution. It's very low-level, but it works. Yes, you can buy a cloud offering, but physical disk is still way cheaper than "cloud disk". You don't have all the cloud features, but on the other hand, the data are 100% yours, on a server that you control.

I don't buy that it's "the simplest". Just about every major Linux distro ships w/ SFTP enabled out-of-the-box. How is installing an FTP server easier than just using the built-in SFTP server? I've been trying to actively discourage the use of FTP for the last 10+ years. It's not an option because it passes passwords in-the-clear. Protocols that pass cleartext authentication should just be off the table today.

oh sure, SFTP is better, I thought we are comparing FTP/SFTP to DropBox and the like

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#129

Post by JoeAltmaier » Wed, Sep 26, 2012, 3:33 PM UTC

kree10 wrote: post #52

fmavituna wrote: post #40

Earlier quoted context omitted.

d) To not keep 100K users' passwords in a public FTP server :)

I'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?

Engineers and scientists have large datasets to share. Gigabytes. Terabytes. FTP can handle it.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#130

Post by JoeAltmaier » Wed, Sep 26, 2012, 3:34 PM UTC

shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

I wonder why the website package even wrote a log that included plaintext passwords. That's not IEEE's fault, except perhaps a lapse in judgement to use whatever opensource package.