Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

131–140 of 325 posts

Re: Twitch is hacked, and its source code leaked

#131

Post by evandwight »

franga2000 wrote: post #113
twofornone wrote: post #92

Earlier quoted context omitted.

That's something I've wondered - do password hashes tend to be the same across platforms? Is everyone using the same hashing algorithm? Isn't this also what salting is for? Never implemented auth myself.

If everyone did things the way they're supposed to then no, hashes should never be the same between platforms. Using the same algorithm is likely, but as you said, salting solves that. But mistakes such as salting with just the username are sometimes made even by very large companies and in that case, hashes could be the same.

Why does it matter if hashes are the same?

That only tells you the passwords are the same.

Re: Twitch is hacked, and its source code leaked

#132

Post by yawaworht1978 »

leros wrote: post #8
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

Indeed , how could this happen, really curious.

So let's say someone with access to all GitHub repos gave the password to someone else, maybe then it was downloaded from another machine?

Or someone stole the credentials and downloaded from another machine?

Or someone got access to such a machine?

It's it not possible to prevent these cases?

How long does such a download take?

Re: Twitch is hacked, and its source code leaked

#133

Post by bawolff »

cheeze wrote: post #117
xmprt wrote: post #53

Earlier quoted context omitted.

With a phone you need my passcode to accept to 2FA request (assuming lock screen notifications are disabled). I think yubikeys can work without a passcode as long you plug it in right?

It's still the same, 2fa. With a Yubikey, you need to use your password to log in to your computer, and then need to auth using Yubikey. With OTP app, you need to use your password to log into your computer, passcode for phone, and then auth. In both cases, it's something you know, and something you have. You could argue that the app based is a bit more secure in that you need two passwords. On the flipside, if your…

Why would you need to log into your computer with a yubikey? Wouldn't any computer (including the attacker's computer) work?

Re: Twitch is hacked, and its source code leaked

#134

Post by [deleted] »

evandwight wrote: post #131
franga2000 wrote: post #113

Earlier quoted context omitted.

If everyone did things the way they're supposed to then no, hashes should never be the same between platforms. Using the same algorithm is likely, but as you said, salting solves that. But mistakes such as salting with just the username are sometimes made even by very large companies and in that case, hashes could be the same.

Why does it matter if hashes are the same? That only tells you the passwords are the same.

[deleted]

Re: Twitch is hacked, and its source code leaked

#135

Post by hn_throwaway_99 »

AshamedCaptain wrote: post #17
leros wrote: post #8

Earlier quoted context omitted.

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

Trying to protect against leaking developers/employees is like trying to protect against lone gunman terrorists: useless. And, if you try anyway, it is likely to cause more annoyance to everyone involved than actual protection (think TSA).

This isn't accurate. There are certainly companies that have extremely in-depth Data Loss Prevention toolsets and teams - everything anyone downloads or moves is logged and alerts fire if things look out of the ordinary. Google clearly had tons of data about how Anthony Levandowski was able to exfiltrate lots of info when he left.

The issue that building these systems accurately so they are NOT a constant annoyance is difficult, expensive, and takes a large team to support well.

Re: Twitch is hacked, and its source code leaked

#137

Post by jmazzi »

iuri1 wrote: post #129

Since the main leaked files are from github, I'm assuming they got it from one of the many reported github auth flaws which don't get fixed and allows access to private repositories. Or more unlikely, via someone getting sloppy with their laptop. Now I wonder if the commit history has database dumps or sensitive information, which is a common practice, or if any twitch servers have been accessed through a breach or p…

Which Github auth issues are you referring to?

Re: Twitch is hacked, and its source code leaked

#140

Post by growt »

axpy906 wrote: post #87
tyingq wrote: post #76

Earlier quoted context omitted.

>Then I'm not sure what you can even do with those Assume some end users used the same passwords on other, non-twitch accounts. That's what makes hacked passwords valuable, no matter where they came from.

Pretty much this. If they gain one email/username password combination - they can use it elsewhere.

If they are properly hashed and salted, they can not.
Post reply on HN