Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

201–210 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#201

Post by Retric »

fpgaminer wrote: post #172
hardly_a_mirage wrote: post #153

Earlier quoted context omitted.

> The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises. Something to consider is that malware-based compromises of personal systems don't raise as much brouhaha as corporate-level compromises.

My statement is based not on frequency of news, but rather on my understanding of the provenance of passwords in password lists. The vast majority of passwords in password lists are sourced from service hacks; not from user malware. And that makes sense. Malware events net maybe thousands of user passwords? On a good day maybe 100k. But hacks of major services like LinkedIn ... those yielded hundreds of millions of p…

At the height of gold farming when hacking WoW accounts was very profitable 1/2 our guild was individually hacked over a six month period. Normally it's much harder to detect password being leaked but it was really noticeable and hardware/cellphone tokens made a huge difference.

So, I suspect the reverse is true with standalone PC's being more likely to be compromised, what makes this less noticeable is it's harder to automated extracting value from those hacked accounts beyond sending gmail spam etc.

PS: This is also why cryptocoin software on users machines is basically a non starter.

Re: Twitter urges users to change passwords after computer 'glitch'

#202

Post by tehbeard »

jrochkind1 wrote: post #177
ams6110 wrote: post #165

Earlier quoted context omitted.

Makes sense, and then you're getting into something akin to SSH key pairs, and I know from experience that many users can't manage that especially across multiple client devices.

There are probably ways to make it reasonable UX, but they probably require built-in browser (or other client) support. Someone in another part of this thread mentioned the "Web Authentication API" for browsers, which I'm not familiar with, but is possibly trying to approach this?

Web Auth API (authn) does try to make it usable.

It ties in with the credential management API (A way to have the browser store login credentials for a site, a much less heuristic based approach than autocomplete on forms) and basic principle is generate a key pair, pass back public key to be sent to server during registration. On login generate a challenge value for the client to sign. I don't think iirc the JS code ever sees the private key, only the browser sees it.

Re: Twitter urges users to change passwords after computer 'glitch'

#203

Post by gsich »

LyndsySimon wrote: post #162
gsich wrote: post #123

Why even hash the password on the remote side, shouldn't some challenge-response hashing be more secure? The most likely downside is that without JS it won't work.

If you hash the password on the client, the hash made on the client is now the password. It's easy enough to send the hash directly, and the server is none the wiser. That's not to say it's a bad idea, though. I have used client-side hashing in the past to allow passwords of arbitrary length while using finite network resources.

True, but at least no sensitive information is available on the server side. People do reuse passwords.

Re: Twitter urges users to change passwords after computer 'glitch'

#205

Post by jimktrains2 »

hunter2_ wrote: post #174
jrochkind1 wrote: post #156

Earlier quoted context omitted.

nah, that just makes the "hashed password" the equivalent of the cleartext password. Whatever it is your client sends to the server for auth is the thing that needs to be protected. If the client sends a "hashed password", that's just... the password. Which now needs to be protected. Since if someone has it, they can just send it to the server for auth. But you can do fancy cryptographic things where the server never…

"Since if someone has it, they can just send it to the server for auth" unless it's only good for a few moments (the form you type it into constantly polling for a new nonce).

Or you could just use PAKE or SRP.

Re: Twitter urges users to change passwords after computer 'glitch'

#206

Post by bradjohnson »

gowld wrote: post #135
jms703 wrote: post #66

Earlier quoted context omitted.

"I should not have said we didn’t have to share. I have felt strongly that we should. My mistake." https://twitter.com/paraga/status/992146630232043520

Felt strongly that [Twitter] should have... "said we didn't have to share"? "shared"? Parag needs a Comms director to handle is Twitter account.

Pretty obviously "shared" given the context.

Re: Twitter urges users to change passwords after computer 'glitch'

#207

Post by danso »

oneeyedpigeon wrote: post #88

> The glitch was related to Twitter’s use of a technology known as “hashing” that masks passwords as a user enters them by replacing them with numbers and letters, according to the blog. Sigh. They appear to have confused hashing with asterisks. > A bug caused the passwords to be written on an internal computer log before the hashing process was completed, the blog said. So "related" in almost no way whatsoever, then…

> Sigh. They appear to have confused hashing with asterisks.

No they didn't. Or else the excerpt you quoted would have said literally that, i.e.

> The glitch was related to Twitter’s use of a technology known as “hashing” that masks passwords as a user enters them by replacing them with asterisks.

While the description of "hashing" is tortured, it seems to be technically correct, if you don't make specific assumptions about the phrase "that masks passwords as a user enters them by replacing them". But yes, the normal interpretation of the present tense would be that the characters are being hashed as the user types in the password, rather than after the form submission.

Re: Twitter urges users to change passwords after computer 'glitch'

#208

Post by danso »

oneeyedpigeon wrote: post #100
Johnny555 wrote: post #90

Earlier quoted context omitted.

The state of technology reporting in the mainstream press really makes me despair sometimes. The problem is that the mainstream press writes for mainstream users, and the state of science/technology understanding in the general public is the real problem.

I hear what you're saying, but I think — in this case — the article's just giving too much irrelevant information. I think most mainstream users I know would understand it if it were written something like: > A bug caused passwords to be written on an internal computer log, the blog said.

Understand what, exactly? I don't believe most users understand that passwords aren't necessarily stored in plaintext (on a system log, or in a database).

Re: Twitter urges users to change passwords after computer 'glitch'

#209

Post by jchw »

jrochkind1 wrote: post #156
ams6110 wrote: post #152

Earlier quoted context omitted.

So best practice would be that the cleartext password is never sent to the server, so they could never log it even accidentally. That means the hashing needs to be done client side, probably with JavaScript. Is there any safe way to do that?

nah, that just makes the "hashed password" the equivalent of the cleartext password. Whatever it is your client sends to the server for auth is the thing that needs to be protected. If the client sends a "hashed password", that's just... the password. Which now needs to be protected. Since if someone has it, they can just send it to the server for auth. But you can do fancy cryptographic things where the server never…

I believe you could use a construction like HMAC to make it so that during authentication (not password setting events) you don't actually send the token. But if someone is already able to MITM your requests, what are the odds they can't just poison the JavaScript to send it in plaintext back to them?
Post reply on HN