Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tuts+ Premium Account Security Compromised

notes.envato.com

Post reply on HN
Print view View original

21–30 of 70 posts

Re: Tuts+ Premium Account Security Compromised

#21

Post by mun2mun »

anons2011 wrote: post #6
bluetidepro wrote: post #4

This is ridiculous. In the email I received from Envato it says the following: "-- What To Do (1) Update passwords on ANY service you use that uses the same password as you had on Tuts+ Premium. (2) In particular you should consider your own email account, PayPal, Moneybookers, and other payment services. These are the most sensitive targets, and if you had the same password, you should consider this an urgent priori…

>You have to be kidding me? Do I really need to start using unique passwords on every site that I use? Errr, ...yes!

For this reason Facebook connect/Twitter login are becoming popular. 1password, lastpass, keypass etc are not that popular among casual users.

Re: Tuts+ Premium Account Security Compromised

#22

Post by stef25 »

pwny wrote: post #9

Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my own, how hard can it be? Getting hacked happens, even to the best but come on, how many times will we have to read blog posts like this one before people wake up? How hard can it be to hash and salt your passwords? Glad I wasn't one of their customers (and nev…

And it's a company that teaches web development ...

Re: Tuts+ Premium Account Security Compromised

#25

Post by vitomd »

"Our current Tuts+ Premium app makes use of a third party plugin that unfortunately stores passwords in cleartext (i.e. unencrypted)"

That make me sad. If you use a plugin, you use it because it's a better and a proven solution , not because you are lazy. Sad day..

Re: Tuts+ Premium Account Security Compromised

#26

Post by mnicole »

stef25 wrote: post #22
pwny wrote: post #9

Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my own, how hard can it be? Getting hacked happens, even to the best but come on, how many times will we have to read blog posts like this one before people wake up? How hard can it be to hash and salt your passwords? Glad I wasn't one of their customers (and nev…

And it's a company that teaches web development ...

Serious question; all of these tutorial sites.. are any of them a reliable source for web dev or are they just another Smashing Magazine where people get paid to write about things they don't understand?

Re: Tuts+ Premium Account Security Compromised

#27

Post by pwny »

jgrahamc wrote: post #20

We should start a new award for web sites with crap password security. Let's name it after Robert Morris (Senior) who essentially inventing password hashing. A Morris Award would be a bit like a Darwin Award for people who've failed to learn anything about password security and in doing so have been exposed. Recent Morris Award winners: LinkedIn, last.fm, eHarmony, Tuts+, ...

I feel weekend project potential here!

Re: Tuts+ Premium Account Security Compromised

#28

Post by stef25 »

mnicole wrote: post #26
stef25 wrote: post #22

Earlier quoted context omitted.

And it's a company that teaches web development ...

Serious question; all of these tutorial sites.. are any of them a reliable source for web dev or are they just another Smashing Magazine where people get paid to write about things they don't understand?

Honestly I don't think their tutorials are half bad and I enjoy reading Smashing Magazine. Mainly for fluffy stuff. For security & scaling stuff go elsewhere.

Re: Tuts+ Premium Account Security Compromised

#29

Post by UnoriginalGuy »

pwny wrote: post #9

Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my own, how hard can it be? Getting hacked happens, even to the best but come on, how many times will we have to read blog posts like this one before people wake up? How hard can it be to hash and salt your passwords? Glad I wasn't one of their customers (and nev…

In principle I agree: it is bad practice.

But let's remember that either plain text or one-way hashed they will be broken eventually. The only thing hashing passwords buys you is a little bit of time before the "hacker" can use those passwords to access the compromised system.

It doesn't, for example, protect you from password re-usage issues. You also have to reset the passwords either way.

I think getting broken into is the biggest problem here; everyone has recently spent far too much time talking about hashes instead of asking questions about how the real break-in occurred at these businesses.

Re: Tuts+ Premium Account Security Compromised

#30

Post by creativityhurts »

jgrahamc wrote: post #20

We should start a new award for web sites with crap password security. Let's name it after Robert Morris (Senior) who essentially inventing password hashing. A Morris Award would be a bit like a Darwin Award for people who've failed to learn anything about password security and in doing so have been exposed. Recent Morris Award winners: LinkedIn, last.fm, eHarmony, Tuts+, ...

More potential "winners" are here http://plaintextoffenders.com/
Post reply on HN