Archive of the original 4chan post from this morning: https://archive.is/8rQNK
Twitch is hacked, and its source code leaked
251–260 of 325 posts
Re: Twitch is hacked, and its source code leaked
#252Earlier quoted context omitted.
The point here is that once you brute force the plaintext password, the same password might be used elsewhere.
What if you did something like hash(plaintext_pw+"twitchsalt") ---> hash(browser_hash + db_salt)
If I understand this right, the problem is "twitchsalt" has to be known so that you can generate the same hash for future logins. So it's just one iteration of hashing more for a brute force attempt (modern hashing algorithms already use multiple iterations of hashing to make brute forcing harder)
Re: Twitch is hacked, and its source code leaked
#253I cant wait for some to look at the experiments they ran.
I imagine something like:
commit b160b523b0fa6a747fd217fed778f281334ee64f (HEAD -> master)
Author: john smith
Date: Wed Oct 6 17:41:42 2021 +0200
exp_promote_gambling
make experiment to promote gambling content for kids with loot boxes to see if they donate more money, if not we will try to show them promiscuous content.
The engineers of nazi Germany spend time to make gas chambers that use human fuel..
Now developers are literally and knowingly making addict kids, teen suicides, depression, finding more innovative and creative ways to stalk us, etc etc.
I recently interviewed a person who was working in a gambling company, and they knew very well what they were doing there, who were they hurting and exactly how much. How is that different than selling drugs to addicts?
We are engineering the next gas chambers, and we have to be held accountable, and we have to be able to say 'no, i am not going to build this feature' without losing our job. This is extreme statement, but things can not stay like this.
Re: Twitch is hacked, and its source code leaked
#254We're just walking into a future where these kind of leaks happen every other day, aren't we ?
We are already there it seems
Re: Twitch is hacked, and its source code leaked
#255Earlier quoted context omitted.
Its still more secure. Rubber hose cryptanalysis applies to both equally, but that doesn't mean there aren't other attacks that apply to totp which don't to yubikeys. More secure != perfectly secure.
With a phone you need my passcode to accept to 2FA request (assuming lock screen notifications are disabled). I think yubikeys can work without a passcode as long you plug it in right?
Amazon still has a passkey requirement, it's not just a touch of the key, and these passwords are different to your user passwords at login.
Re: Twitch is hacked, and its source code leaked
#256Re: Twitch is hacked, and its source code leaked
#257As an avid Twitch streamer, what do I need to do to protect myself?
Report your earnings on your tax.
Re: Twitch is hacked, and its source code leaked
#258Earlier quoted context omitted.
On one hand I understand why you'd ban that kind of content, on the other it's essentially public information now... what's the point.
Because everyone else doing it still doesn't make it right.
The streaming part or the downloading/looking at code?
You can look at leaked source code for educational purposes in most places (not legal advice). As far as I understand leaks are commonly used in vulnerability research for example (if the bad guys can use it so can bug hunters).
Streaming copyrighted material is a separate issue - but using it for "criticism, comment, news reporting, teaching" should fall under fair use, no?
Re: Twitch is hacked, and its source code leaked
#259Someone actually started streaming going through the code ... on twitch. https://www.twitch.tv/deepfrieddev
"Sorry. Unless you’ve got a time machine, that content is unavailable." Too bad, it would be nice to see someone go through and document how Twitch works. I've never worked at "web scale" so I'd probably learn a lot.
Well, you know what they say, "Self help is the best help."
Re: Twitch is hacked, and its source code leaked
#260Earlier quoted context omitted.
Pretty much this. If they gain one email/username password combination - they can use it elsewhere.
I would be very deeply concerned if Twitch, a multi-billion dollar company owned by Amazon, does not properly hash and salt the passwords of its users.
You can still run those "top billion popular password" lists against properly salted/hashed passwords.