Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay user data for sale?

pastebin.com

Post reply on HN
Print view View original

21–30 of 110 posts

Re: eBay user data for sale?

#21

Post by seabee »

cauterize wrote: post #11
ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

I've had an eBay account for 10+ years. I thought a "hey, we screwed up, please change your password" type email would be nice.

They did force a password reset on everyone trying to log in yesterday; even if they already reset their password when they first heard the news, effectively locking them out for the evening because their password reset system was understandably overwhelmed with requests. Thanks eBay!

Re: eBay user data for sale?

#22

Post by thefreeman »

Mithaldu wrote: post #18
ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

I am not an expert by any means, but I believe pbkdf2 is a recommended key stretching function for a hashing method (which looks to be sha256). http://en.wikipedia.org/wiki/PBKDF2

I think cracking difficulty depends on how many "iterations" they use though.

Re: eBay user data for sale?

#23

Post by thefreeman »

aetherson wrote: post #10
ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

Reports indicated that the passwords were encrypted, but I do not believe they've mentioned what the encryption scheme is. Plaintext uniquely identifying information like Date of Birth was included, however.

Judging by the prefix to one of the link pasted hashes, looks like PBKDF2 with sha256?

Re: eBay user data for sale?

#26

Post by tomp »

Why the ":s"? Are they supposed to offer it for free?

Jokes aside, this, hopefully followed by a (class-action?) lawsuit, is the only way that the companies will learn how to properly store user data. The engineers have been talking about "best practices" for a very long time, but it appears managers only understand the language of money.

Re: eBay user data for sale?

#27

Post by phpnode »

Mithaldu wrote: post #18
ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

it's going to be computationally difficult but not impossible to break an individual password, but breaking all of them is unlikely in our (solar system's) lifetime.

However, if you were targeting a specific user and they didn't use a particularly strong password, it's possible that you could brute force it.

Re: eBay user data for sale?

#29

Post by surreal »

Mithaldu wrote: post #18
ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

Looks to me like the $ signs are acting as delimiters, and that that hash is made up of:

cipher/hash: pbkdf2_sha256

cost factor: 12000

salt: zhMKabMgayvK

hash: iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc=

This exact technique (pretty much) is described here: http://exyr.org/2011/hashing-passwords/. It's a decent, secure way to hash passwords.

Cost factor of 12000 seems solid to me (depends on the hardware they're running on but I'd say brute forcing your way through that would be pretty impossible)

Re: eBay user data for sale?

#30

Post by tmorgan »

thefreeman wrote: post #22
Mithaldu wrote: post #18

Earlier quoted context omitted.

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

I am not an expert by any means, but I believe pbkdf2 is a recommended key stretching function for a hashing method (which looks to be sha256). http://en.wikipedia.org/wiki/PBKDF2 I think cracking difficulty depends on how many "iterations" they use though.

I assume 12000 iterations by the looks of that $ delimited string, I assume they're storing the parameters as,

hash_func$iterations$salt$derived_key

Post reply on HN