Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tuts+ Premium Account Security Compromised

notes.envato.com

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Tuts+ Premium Account Security Compromised

#41

Post by Xylakant »

whichdan wrote: post #13
charliesome wrote: post #8

Earlier quoted context omitted.

From the article: Tuts+ Premium is the only Envato service that operates with cleartext passwords, and it was a known internal issue for us, with a plan currently in progress to upgrade away from the current plugin.

The sad thing is, it's completely trivial and non-disruptive to switch to from a cleartext database to a hashed+salted one.

Not if you depend on a software that requires plaintext passwords (as they obviously do). Whether it's a wise choice using such a software is open to discussion though.

Re: Tuts+ Premium Account Security Compromised

#42

Post by StavrosK »

bluetidepro wrote: post #4

This is ridiculous. In the email I received from Envato it says the following: "-- What To Do (1) Update passwords on ANY service you use that uses the same password as you had on Tuts+ Premium. (2) In particular you should consider your own email account, PayPal, Moneybookers, and other payment services. These are the most sensitive targets, and if you had the same password, you should consider this an urgent priori…

I use SuperGenPass (EnigmaPass for Chrome). I don't have to store passwords, I just have to remember the master one.

Re: Tuts+ Premium Account Security Compromised

#44

Post by yashchandra »

It is high time a site's registration form/process has a confirmation box confirming that they do not store passwords unencrypted before the user clicks "sign me up". This is getting ridiculous. I unfortunately used another site recently that sent me my password back in clear text over email.

Re: Tuts+ Premium Account Security Compromised

#45

Post by yashchandra »

UnoriginalGuy wrote: post #29
pwny wrote: post #9

Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my own, how hard can it be? Getting hacked happens, even to the best but come on, how many times will we have to read blog posts like this one before people wake up? How hard can it be to hash and salt your passwords? Glad I wasn't one of their customers (and nev…

In principle I agree: it is bad practice. But let's remember that either plain text or one-way hashed they will be broken eventually. The only thing hashing passwords buys you is a little bit of time before the "hacker" can use those passwords to access the compromised system. It doesn't, for example, protect you from password re-usage issues. You also have to reset the passwords either way. I think getting broken in…

"I think getting broken into is the biggest problem here"

Perhaps. But that still does not undermine the importance of storing passwords securely with encryption. The idea is not to completely avoid an attack (crackers are pretty determined ), the idea is to delay or make it harder for the bad guys. so yes, encryption matters a lot.

Re: Tuts+ Premium Account Security Compromised

#47

Post by pwny »

UnoriginalGuy wrote: post #37
pwny wrote: post #32

Earlier quoted context omitted.

False. Getting broken through will happen because there are so many holes to plug, while strong and slow hashing + salting (while being extremely easy to set up) will make it so it's not even worth it for the attacker to crack passwords when he/she inevitably gets in. Of course we need to plug holes in security and prevent people from getting in (SQL injection vulnerabilities are just as important an offence) but mig…

What is "false?" You deeply over-estimate how much effort it takes someone to break even correctly protected hashes. Most passwords are extremely poor and can be broken even without a rainbow table in less than a couple of hours. Hell I can spin up an EC2 instance right now for free (AWS Free) running Linux and then just leave it there for 12 months at zero cost; giving me a nice formatted list of e-mail addresses an…

While I completely agree with you that the attacker getting into the database is an issue in the first place, "what is false" is that this is an excuse to divert the problem from blatant lack of understanding of basic principles in security.

My way of seeing this (and you might have a different opinion, which I respect as well. I want it to be clear my comment wasn't a personal attack) is that I use a strong password that would not be easily crackable by dumb bruteforce or rainbow tables. Therefore even if an attacker breaks in to a service that I use, steals database tables containing hashed and salted passwords and gets cracking, the likelihood that he/she breaks MY password is relatively low. Now the minimal effort from the company providing the service went to great length to complement MY effort of choosing a strong password.

There are a lot of problems in security. Weak passwords and password reuse are the burden of the user. Correct storing of passwords and preventing intrusions are the burden of the developer. Neither of those are an excuse for skipping hashing and salting because "it can be broken easily". You mention 12 months yourself, I'm sure my bcrypt'd/salted 16 character non-dictionary word unique password would discourage any cracker (and take more than 12 months to crack) and all of that was a lot easier to set up than a dedicated password storage solution.

Point is, do whatever you can to protect data. Better safe than sorry.

Re: Tuts+ Premium Account Security Compromised

#48

Post by Smerity »

UnoriginalGuy wrote: post #29
pwny wrote: post #9

Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my own, how hard can it be? Getting hacked happens, even to the best but come on, how many times will we have to read blog posts like this one before people wake up? How hard can it be to hash and salt your passwords? Glad I wasn't one of their customers (and nev…

In principle I agree: it is bad practice. But let's remember that either plain text or one-way hashed they will be broken eventually. The only thing hashing passwords buys you is a little bit of time before the "hacker" can use those passwords to access the compromised system. It doesn't, for example, protect you from password re-usage issues. You also have to reset the passwords either way. I think getting broken in…

The issue is that if I were a hacker I'd have a program that: a) takes an email and password, b) checks if email is in ["gmail", "yahoo", "msn", "facebook", ...], c) attempts to access account using given password and then d) if successful, changes password / mines data.

This is not difficult. There may even be programs that already exist for this. The only difficulty would be not getting blocked by those services after a large number of incorrect attempts, but leverage services like Tor/EC2/botnets and that becomes a null issue.

With password hashing it would at least be _some_ amount of time between accessing the leaked data and havoc. Cleartext means disaster is instantaneous.

Re: Tuts+ Premium Account Security Compromised

#49

Post by beezee »

What is really absurd is they've gone offline and given people no way to confirm their password. Their suggestion:

"If you can’t remember what your Tuts+ Premium password was, we encourage you to change passwords on all services you use"

All I need is to try a handful of "important" passwords, make sure that none of them work for this compromised service, and I can go on with my day. But they figure, hey, if you can't remember our password, go change them all, not our problem.

Real brilliant way to handle it.

Post reply on HN