OVH Security Incident
31–40 of 55 posts
Re: OVH Security Incident
#32OVH has come a long way. They used to be cheap and bad at service and totally incommunicado about any issues. Then a few years back something changed and they started to work on their image. Their still cheap, but their service is good and getting better and they seem to have nailed the communications angle. Good for them. Between OVH, Hetzner and Leaseweb the EU hosting space is doing fine.
I might add that OVH has a US arm as well - prices are competitive with Hetzner at least.
I've been wanting to try them. Does this security breach have any implications for the US data center, or was this pretty localized to the European arm?
Re: OVH Security Incident
#33Earlier quoted context omitted.
It doesn't matter; you should assume your password is lost. Follow their advice: "we advise you to change the password for your user name."
It matters a great deal (well, not to me, I don't use the service). Password reuse is common, and the way to fix that is good quality password hashing. If I used OVH, I'd need to change my password everywhere now. If I used someone competent (i.e. they still have bugs but they use bcrypt), they'd have lost: $2a$10$NkYCXBjWeVP0rJUlfl0VL.d66EvJjbVUA/YEsmBSyTZOnbY0/anxa which is a bcrypt hash of my most secure password.…
No, the password should now be considered compromised regardless of how it was hashed and regardless of how many other sites you used it on and how annoying it would be to change them all.
Re: OVH Security Incident
#34Hacked again? https://bitcointalk.org/index.php?topic=186902.msg1936161#ms...
Quite a different incident, I think.
Re: OVH Security Incident
#35 An email will be sent today with the new password
Re: OVH Security Incident
#36An email will be sent today with the new password Password in plain-text? I understand the convenience factor but doesn't sound very secure...
If someone can read your email, they don't need your password. They can just initiate a password reset.
https://www.ovh.co.uk/cgi-bin/nic/nicPassword.cgi
Re: OVH Security Incident
#37"The encryption password is "Salted" and based on SHA-512, to avoid brute-force attacks. It takes a lot of technical means to find the word password clearly"
"clearly?" OVH is wrong. Based on this information alone, it is not sufficient to say how costly it is to recover the password. SHA-512 needs to be iterated to make it costly to brute force.
For example, a raw SHA-512 hash, even salted, is not iterated and is easy to brute force. But multiple passes, as in crypt-SHA-512, are iterated and very costly to brute force.
Re: OVH Security Incident
#38"The encryption password is "Salted" and based on SHA-512, to avoid brute-force attacks. It takes a lot of technical means to find the word password clearly" "clearly?" OVH is wrong. Based on this information alone, it is not sufficient to say how costly it is to recover the password. SHA-512 needs to be iterated to make it costly to brute force. For example, a raw SHA-512 hash, even salted, is not iterated and is ea…
If one's password is "password", the choice of hash algorithms and salts is irrelevant anyway.
Re: OVH Security Incident
#39Earlier quoted context omitted.
I might add that OVH has a US arm as well - prices are competitive with Hetzner at least.
I've been wanting to try them. Does this security breach have any implications for the US data center, or was this pretty localized to the European arm?
Did you RTFA?
Re: OVH Security Incident
#40If I was a customers, I'd be asking if "based on SHA-512" means some kind of iterated algorithm, or if have they lost my password?
"based on" could literally mean "some shit our lead developer cooked up that's like SHA but not really."
I would hope "based on" doesn't mean that but why use the phrasing at all? Either it's SHA-512 or it isn't and if it isn't, confidence is definitely not instilled.