And now we wait for the dump to show up... will be usefull, larger then the rockyou plain.
Hack of Cupid Media dating website exposes 42 million plaintext passwords
21–30 of 168 posts
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#22Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing. Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide: https://en.wikipedia.org/wiki/Secur…
What about Facebook login (or other oauth based systems)?
Seems to me this solves most of the problem.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#23This is getting ridiculous. When are we going to see legislation enacted to take these people to task? Surely there is a case to be made that their negligence causes (or has the potential to cause) real harm to their users. We need a Saul Goodman to put together a class action.
> When are we going to see legislation enacted to take these people to task? And how would you enforce this ? mandated paid audits provided by companies that have lobbyists and friends in Washington ? Enough with the laws, laws are not an answer to every problems. If there is harm , let the users sue, but stop with your laws...
Pro-active enforcement is not always necessary. The possibility of a large fine if found in breach of the law is usually enough for responsible companies to take the matter seriously.
Of course, you also need guidelines for implementation.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#24Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing. Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide: https://en.wikipedia.org/wiki/Secur…
"The answer" doesn't exist and it never will. Everyone has to do their part. Services that store passwords in plaintext should definitely be publicly shamed, every single time.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#25This is getting ridiculous. When are we going to see legislation enacted to take these people to task? Surely there is a case to be made that their negligence causes (or has the potential to cause) real harm to their users. We need a Saul Goodman to put together a class action.
> When are we going to see legislation enacted to take these people to task? And how would you enforce this ? mandated paid audits provided by companies that have lobbyists and friends in Washington ? Enough with the laws, laws are not an answer to every problems. If there is harm , let the users sue, but stop with your laws...
> And how would you enforce this ? ... mandated paid audits
No, that would be quite silly and wouldn't work.
It could simply be reactive rather than proactive. When an incident occurs where sensitive user data is exposed, simply launch an investigation into whether there were "adequate" protections in place. If it is found that sensitive data was stored unencrypted, for example, put the directors of the company behind bars for negligence.
I'm dreaming of course. Steal a loaf of bread, life in jail without parole. Expose the private data of millions... have a strong whisky, put out a press release, head to the golf course.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#26Earlier quoted context omitted.
I also use Keepass....but why the smeg do I need to do this? My browser should be deriving per-site passwords for me at a minimum
LastPass has browser plugins that do this. Edit: Additionally LastPass supports login to your LastPass account via password + OTP combination such as Google Authenticator and Yubikeys.
LastPass is awesome.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#27I can't get my head around how this still happens. I few years back I took over development of an old PHP website, which had a horrible code base (no framework or library, not even MVC). This site had around 30,000 users, all with plain text passwords. It took me all of a couple of hours to get the site using bcrypt. I'm not saying I'm some kind of super-rock-ninja-star developer, just that this is so easy to fix, ev…
Because of this: If a site is using plaintext password often the owner asked for it. They wanted their users to be able to recover their passwords. And the dev didn't understand why this was a bad idea. They need to be educated, convinced and then convinced that the time you're about to spend on fixing this is more important than the 101 other things going wrong because the original dev wasn't very good. And isn't ac…
It's quite possible the dev knew it was a bad idea and maybe even argued against it but was told to implement it this way anyway.
The problem a dating site probably has is people who sign up accounts and then stop using them. They want to send these users reminder emails in the hope that some of them re-engage.
Problem is that some of these users have probably forgotten which password they use for that website, and some % of those will not bother using the password reset mechanism.
So someone in marketing has the bright idea of sending emails that include the username/password combo, the dev explains why this is a terrible idea and then gets overruled.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#28Just a random question: Is there anything that gives companies incentive to prevent such hacks? It seems that there is no consequences at all, except for some loss of reputation in tech community. Is there a way to put legal pressure on tightening up security?
That's pretty much country dependent, local legislation on data protection varies. (And even then AFAIK is limited to sensitive data, such as race/religion/banking, not the password to some website...)
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#29Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing. Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide: https://en.wikipedia.org/wiki/Secur…
"The answer" doesn't exist and it never will. Everyone has to do their part. Services that store passwords in plaintext should definitely be publicly shamed, every single time.
The problem is that "publicly shamed" means "shamed amongst security geeks". Most websites main demographic is not security geeks.
Re: Hack of Cupid Media dating website exposes 42 million plaintext passwords
#30This is getting ridiculous. When are we going to see legislation enacted to take these people to task? Surely there is a case to be made that their negligence causes (or has the potential to cause) real harm to their users. We need a Saul Goodman to put together a class action.
Yes, the government would surely do a great job legislating development standards. Just look how terrifically they've handled software patents.