Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adobe credentials and the serious insecurity of password hints

troyhunt.com

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Adobe credentials and the serious insecurity of password hints

#21

Post by mdpopescu »

patio11 wrote: post #9

I don't have the resources of a Facebook, but I'd pay a few hundred bucks a year for a HTTPS secured REST API which let me post an email address and receive a list of candidate passwords. Bonus for a callback if someone I've queried gets added. The service would maintain that list in a fashion similar to whitehat security researchers. Use case is to implement the FB-style security escalation for high-value accounts a…

The noise you hear is five hundred patio11 followers writing that app... myself included :)

Re: Adobe credentials and the serious insecurity of password hints

#22

Post by cdjk »

How is Facebook getting the plaintext passwords to compare to their hashed user passwords? Since the passwords are 3DES encrypted, only adobe should be able to do that.

They could just be using email addresses, but that seems rather blunt.

I'm not a huge fan of Facebook, but what they're doing does seem like an excellent idea.

Re: Adobe credentials and the serious insecurity of password hints

#24

Post by sp332 »

cdjk wrote: post #22

How is Facebook getting the plaintext passwords to compare to their hashed user passwords? Since the passwords are 3DES encrypted, only adobe should be able to do that. They could just be using email addresses, but that seems rather blunt. I'm not a huge fan of Facebook, but what they're doing does seem like an excellent idea.

The passwords were all encrypted with the same key, and ECB mode still leaks some patterns. Jeremi Gosney of Stricture Consulting Group was "fairly confident" of his decoding of many of the passwords. http://www.zdnet.com/just-how-bad-are-the-top-100-passwords-...

Edit: oh it's the same guy who has this beast of a cracking cluster! http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...

Edit2: more details about how the decoding works http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-pass...

Re: Adobe credentials and the serious insecurity of password hints

#25

Post by sp332 »

ohwp wrote: post #2

I got Ghostery installed, the page loads and then suddenly the text of the article is removed. I know I know, I just shouldn't use Ghostery but I like to have a little privacy online. Sorry I won't return to your site again...

Try using Readability. Even if ghostery blocks the content after it loads, Readability will just format it and show it to you, without sending data to Disqus et al.

Re: Adobe credentials and the serious insecurity of password hints

#26

Post by taeric »

sp332 wrote: post #24
cdjk wrote: post #22

How is Facebook getting the plaintext passwords to compare to their hashed user passwords? Since the passwords are 3DES encrypted, only adobe should be able to do that. They could just be using email addresses, but that seems rather blunt. I'm not a huge fan of Facebook, but what they're doing does seem like an excellent idea.

The passwords were all encrypted with the same key, and ECB mode still leaks some patterns. Jeremi Gosney of Stricture Consulting Group was "fairly confident" of his decoding of many of the passwords. http://www.zdnet.com/just-how-bad-are-the-top-100-passwords-... Edit: oh it's the same guy who has this beast of a cracking cluster! http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... Edit2: more details ab…

I believe the question was more of how does facebook know it was the same password? My guess is this was a "lazy" calculation. That is, they had to get their users to reenter their password so they could check it then. (Make sense?)

Re: Adobe credentials and the serious insecurity of password hints

#27

Post by troyhunt »

ScottWhigham wrote: post #12

Great insight/writeup but the last bit gets to me: Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature. It's a classic case of someone criticizing one important feature without suggesting viable alternatives. He might as well have said, Gasoline engines are evil and they add nothing to a world that can't be achieved with a more effic…

The viable alternative is in the sentence you quoted:

"Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature."

Secure password reset.

Re: Adobe credentials and the serious insecurity of password hints

#28

Post by [deleted] »

taeric wrote: post #26
sp332 wrote: post #24

Earlier quoted context omitted.

The passwords were all encrypted with the same key, and ECB mode still leaks some patterns. Jeremi Gosney of Stricture Consulting Group was "fairly confident" of his decoding of many of the passwords. http://www.zdnet.com/just-how-bad-are-the-top-100-passwords-... Edit: oh it's the same guy who has this beast of a cracking cluster! http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... Edit2: more details ab…

I believe the question was more of how does facebook know it was the same password? My guess is this was a "lazy" calculation. That is, they had to get their users to reenter their password so they could check it then. (Make sense?)

[deleted]

Re: Adobe credentials and the serious insecurity of password hints

#29

Post by sp332 »

taeric wrote: post #26
sp332 wrote: post #24

Earlier quoted context omitted.

The passwords were all encrypted with the same key, and ECB mode still leaks some patterns. Jeremi Gosney of Stricture Consulting Group was "fairly confident" of his decoding of many of the passwords. http://www.zdnet.com/just-how-bad-are-the-top-100-passwords-... Edit: oh it's the same guy who has this beast of a cracking cluster! http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... Edit2: more details ab…

I believe the question was more of how does facebook know it was the same password? My guess is this was a "lazy" calculation. That is, they had to get their users to reenter their password so they could check it then. (Make sense?)

They said in the article, they took the plaintext from the Adobe leak and hashed it using their own login algorithm, then compared hashes. Edit: wait, must have been a different article. Oh well, I read it somewhere :)
Post reply on HN