This is another example of why we should use a unique email address and password for each account. If credit card is needed, use a virtual card. Otherwise one breach exposes our other accounts to compromise. anonaddy.com, simplelogin.com, and privacy.com are some of the services that help with this.
Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
161–170 of 194 posts
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#162Why do we learn that passwords are obsolate and webauthn is the only sane choice?
I believe webauthn requires end users to perform key management. I suspect that is currently a harder task for the average user than a memorized or written-down password. Special hardware tokens may help, but I'm not sure how we'd convince average users to care or buy them. Are there any webauthn only sites, besides demos?
The end user's agent (browser) should handle the key management behind the scenes. Even without hardware tokens it's still at least as good as a software-based password manager. A Hierarchical Deterministic key system similar to the BIP32 scheme used by most Bitcoin wallets[0] would only require a single master private key per user to support any number of unrelated identities. That key could be generated from a master password, synced to each device through an enrollment process, or stored on a hardware token.
[0] https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#163Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surfac…
It became way more frustrating when they started to add ads in the subtitles. It was a few years ago and since then i never even tried to use them
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#164Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surfac…
It became way more frustrating when they started to add ads in the subtitles. It was a few years ago and since then i never even tried to use them
I downloaded the SRT, stripped the ads using SubtitleEdit and embedded them in the MKV file using MKVToolNix to keep it all together.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#165And this is why users protect themselves with services like Firefox Relay, something Dustin Ingram, a Python Software Foundation Director, doesn't appear to understand [1] or care. My email was leaked in this breach, along with many others, an email I used to really value but one I've since relegated to the dumpster fire of "spam slot" because I learned my lesson too late. Dustin has now locked that GitHub to only pr…
I tried modifying my email to a @mozmail.com on opensubtitles.org after the breach and I never received the confirmation email, so I assume they're blocking it.
Anyway I deleted my account.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#166And this is why users protect themselves with services like Firefox Relay, something Dustin Ingram, a Python Software Foundation Director, doesn't appear to understand [1] or care. My email was leaked in this breach, along with many others, an email I used to really value but one I've since relegated to the dumpster fire of "spam slot" because I learned my lesson too late. Dustin has now locked that GitHub to only pr…
I tried modifying my email to a @mozmail.com on opensubtitles.org after the breach and I never received the confirmation email, so I assume they're blocking it. Anyway I deleted my account.
Firefox Relay misses some emails due to misconfiguration of TLS. That might be the issue. This issue report is still open:
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#167Earlier quoted context omitted.
Slightly related, in order to prevent super long passwords from eating up CPU time is it better to hash using sha256 before argon/bcrypt so that the length is constant, or is it better to limit password length to some arbitrary number like 64 characters
> Many implementations of bcrypt truncate the password to the first 72 bytes, following the OpenBSD implementation. https://en.m.wikipedia.org/wiki/Bcrypt This sounds undesirable to me, so I'd support sha256 and an alternative. I'd also recommend adding a max password length to any API. No point in allowing million character passwords.
I'm guessing folks are reading that as endorsement or sha256 over bcrypt. In context with the above post, this is sha256 over truncation.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#168Earlier quoted context omitted.
I believe webauthn requires end users to perform key management. I suspect that is currently a harder task for the average user than a memorized or written-down password. Special hardware tokens may help, but I'm not sure how we'd convince average users to care or buy them. Are there any webauthn only sites, besides demos?
The end user's agent (browser) should handle the key management behind the scenes. Even without hardware tokens it's still at least as good as a software-based password manager. A Hierarchical Deterministic key system similar to the BIP32 scheme used by most Bitcoin wallets[0] would only require a single master private key per user to support any number of unrelated identities. That key could be generated from a mast…
This is new to me, thanks.
Do you know how that supports use cases like if someone wants to change their flight from a hotel computer? I wouldn't want to expose a "master password" to a computer I didn't trust.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#169Again!
They just had a breach like 4 months ago
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#170Earlier quoted context omitted.
The end user's agent (browser) should handle the key management behind the scenes. Even without hardware tokens it's still at least as good as a software-based password manager. A Hierarchical Deterministic key system similar to the BIP32 scheme used by most Bitcoin wallets[0] would only require a single master private key per user to support any number of unrelated identities. That key could be generated from a mast…
This is new to me, thanks. Do you know how that supports use cases like if someone wants to change their flight from a hotel computer? I wouldn't want to expose a "master password" to a computer I didn't trust.
If you don't trust the computer then your best option is a hardware token like the Trezor (which already supports WebAuthn in addition to its cryptocurrency functions). The better ones will include a screen where you can see details like which site you're signing into before confirming the request. Either way, the host computer never gets access to any private keys. It can still do whatever it wants with your login session on that site, though, so you'll want to be careful about logging in to sensitive sites from untrusted PCs. The same applies to password-based logins, of course; moreover, any password you've entered into a public PC should immediately be considered compromised and changed (from a secure device) at the earliest opportunity.
Given any choice in the matter I would suggest using your own equipment to change the flight (e.g. a smartphone), even if it's less convenient.