Earlier quoted context omitted.
Website still managed by a just graduated 21 year old?
A prodigy at 6 years old back in the day.
Lol, I meant to imply the site changed owners over the years ;)
Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
171–180 of 194 posts
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#172Earlier quoted context omitted.
I am confused, the GIF show a login+password for opensubtitles https://camo.githubusercontent.com/a1cd19d17f0484669e61673fa... . Oh, well. I'll give a try next time I launch kodi, thanks for the tip.
It says "Optional" next to the username/password.
Aaaand it's naptime for me :).
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#173Earlier quoted context omitted.
Do we need to toggle this feature somewhere in the settings? I use KeepassDX but I've never been asked by the app to auto-fill in passwords on websites or other apps.
It's a separate keyboard, and needs to be enabled in the keyboard settings of Android. There's a link in the KeepassDX settings. There is a separate autofill feature, but that works quite rarely, maybe 10% of the apps support that, but that makes things even easier.
using chrome's manager and android 11 has native autofill for apps which works 100% so far
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#174Using md5 with no salt while providing paid services and obviously earning income, but in 15 years not even a basic security check? At this point, the web is becoming ridiculous, and stuff like this should be sanctioned.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#175Meh. I treated that site like every random site that requires a login that I think I'll use once: it got my 20 year old Hotmail address, a randomly generated password, and was accessed solely from my VPN IP. The only reason I even set up an account was so that one of my Kodi extensions could hook into it.
I used it like a public site, using a very popular password. Same as in other sites where people share the same account between multiple people. I don't really mind that they got breached. I hope they recover easily and continue to offer their service. And I will not change that password, unless I am denied access. Don't really care if people know it.
Open subtitles does require a pw change, it broke mplayer integration.
Funny, though, they got breached approximately an hour after I went VIP - it's the only way to download an entire season of subtitles, and their maint window correlates to me having spotty subtitle coverage across most of my library. So I gave in and gave money.
Then it's like "invalid password!"
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#176Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surfac…
I have a heartbreaking story for you about a wildly popular site that allowed people to submit album info from CDs (and then everyone else could have automatic metadata when they ripped their own copies of those CDs)
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#177Earlier quoted context omitted.
> simply do bcrypt(md5(password)) This could also be problematic. Password Shucking https://www.youtube.com/watch?v=OQD3qDYMyYQ
I wonder if adding a random salt for each account would help in that situation?. bcrypt(md5(password) + salt) + salt the problem with password shucking would be that they just do a bcrypt(md5) over the list of md5 hashes they have and check if they exist in your database. but if each hash is salted they would need to run every their complete md5 hash list through bcrypt for each account instead of once per database.
No that wouldn't help because you'd need to store the random salt along the hashes. So you can still do: bcrypt(other_leaked_md5 + salt) to shuck it (i.e confirm if both are the same, and skip the bcrypt on your stronger service). The defense is a global "pepper" that would be in the code but not the DB, assuming only the second one leaks.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#178Earlier quoted context omitted.
It's truly appalling that so many times, on HN even, people genuinely recommend paying the ransom because "hackers won't go back on their word cause it'll ruin their reputation". If you're hacked, purge the passwords and reset everyone and do everything in your power to ensure no one can access it in a similar way again. I have no idea why anyone would think a hacker wouldn't simply turn around and sell the data anyw…
I don't personally agree with paying the ransom but the logic seems sound. If you pay them, they might keep their word. After all, how much would they get paid for a list of passwords compared to a ransom payment? If you don't pay them, they are more likely to either sell or leak the lists. In this case, although easy to say now, the correct answer is not to create public web applications until you know how to store…
Well, they hacked the website in the first place, what do they have to lose? I'd say paying the ransom might get back you your files, and that's about it. They can still have a copy and do whatever.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#179Earlier quoted context omitted.
I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use). BitWarden is open source, both server and clients. There's even a thir…
> I use my own domain and give each website their own e-mail address too I wish this was a supported feature on @gmail.com domain (not the +{string} thing). I like the idea, but keep thinking that I'll be uniquely identifiable on every database, since it's almost always going to be just 1 entry for the domain I own.
You could use your own domain, and Google's business offering maybe? I'm not sure if you could register a catch-all email then, but it would enable you to use custom domain, and Gmail's infrastructure and interface.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#180Earlier quoted context omitted.
16 years without reviewing password security seems like a massive oversight. A major leak like this it's a high price to pay to learn this lesson.
The really bad thing is that md5 was considered broken in 2005 by security people like Bruce Schneier. To be fair to them it took till around 2008 for this to become widespread opinion but the signs were on the wall around 2004
You believe sha256 would drastically improve password hashing, being a not broken hash function? In 2006 they likely ran php4 and didn't have much choice what hash to use.