Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quora User Data Compromised

blog.quora.com

Post reply on HN
Print view View original

491–500 of 525 posts

Re: Quora User Data Compromised

#491

Post by baxtr »

jacquesm wrote: post #90
giobox wrote: post #85

Earlier quoted context omitted.

If your main concern is the sheer number of username/unique password combos, pick a good password manager that works well across the devices you use. I’ve literally stopped caring about this aspect of my family’s online life thanks to 1Password. That iOS 12 added OS level integration for the service was the icing on the cake for me.

That's only part of it. The other part is that - invariably - they get hacked.

That’s called life. There are risks. And, no one forced you to use such a platform, just look for another place

Re: Quora User Data Compromised

#492

Post by throwaway66666 »

nindalf wrote: post #421
throwaway66666 wrote: post #327

Earlier quoted context omitted.

And it must end with "-The Quora Team" Because we will leak your data, but we won't bother designating a responsible spokeperson be it security officer, cto, vp of engineering or principal architect. It will be the all nebulous quora team.

I feel like you're criticising just for the sake of it. Firstly, this post is signed by Adam D'Angelo, the CEO and co-founder. If you had opened the link you wouldn't even have had to scroll down, it's literally on the second line, right after the headline. So clearly Quora doesn't do what you've accused them of doing. Secondly, what good does crucifying one person do? I'm sure if they had written it such that one pe…

The email I received from about my real-name being leaked was signed with "The Quora Team". That's kinda ironic, don't you think?

But still, it is not about finger pointing and blaming one individual. It is about a spokeperson for the public.

The guarantee that things will improve. Someone who will handle announcements and communications with the public and will vouch using their real name and reputation that things will improve. Someone who will explain what went wrong and what actions are taken to ensure this does not happen again. Employee training in place? Tier'ed access of data and information to employees. Stricter policies, eg you can't take a database backup home? etc etc.

Again, no crucifixation required, but pinning an identity can be good, because you know that there is someone and who that someone is that puts all their energy into fixing this mess.

Think of someone like Stamos at facebook. I don't know if his contribution in the end was a net positive or not, but it is good to know that there is someone that is focused on the issue.

Re: Quora User Data Compromised

#493

Post by bonsai80 »

jjoonathan wrote: post #104
jedberg wrote: post #91

Earlier quoted context omitted.

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too. For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. A…

Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu item disappeared, bringing clicks-to-login from 1 to ~10. A few weeks ago I saw bitwarden finish their third party security audit and took the opportunity to jump. Couldn't be happier. Autofill fails less, the "copy password" menu works, the mobile experience…

I'm also a happy Bitwarden customer. I especially like that it is all Free Software (combination of GPL 3 and AGPL across various parts), which to me is important for security and privacy related software. I've also had good experiences with Bitwarden support from Kyle, the lead developer and founder.

Re: Quora User Data Compromised

#494

Post by mhh__ »

stickfigure wrote: post #11

Wow. If this had happened a couple years ago, before they made all the anonymous entries truly anonymous, this would have been really ugly. It's a valuable lesson in "don't keep data you don't need". EDIT: A little backstory for non-Quorans. Until early 2017, anonymous Quora answers and comments were anonymous to the public but not actually anonymous in the database (they were still "your" entries). In early 2017 the…

"Don't keep data you don't need" is actually ~illegal (IANAL, obviously) in the UK.

Re: Quora User Data Compromised

#495

Post by mLuby »

MattHeard wrote: post #358
chmars wrote: post #266

https://blog.quora.com/Quora-Security-Update seems to be misleading, especially the introduction. They start with 'some user data was compromised', however, it seems that for 'approximately 100 million Quora users' – that's basically all users! – all user data was compromised … In addition, many questions remain open, for example: Which ' leading digital forensics and security firm' is working for Quora? I hope for Q…

There can only be one digital forensics and security firm in the lead, right? All of the other firms are trailing...

This is more like "leading experts"––there's no "best expert". Just marketing…

Re: Quora User Data Compromised

#497

Post by jwr »

monetus wrote: post #70
jwr wrote: post #45

Earlier quoted context omitted.

Still, I would have thought it is good practice to notify your users if you leak their data to thieves. Quora did the right thing and should be applauded. As a counterexample, it seems that Newegg had a massive breach (thieves installed JavaScript that skimmed credit card numbers for weeks) in August, and even though my credit card was likely stolen, I hever heard about it from Newegg.

How did you find out they did that? Just following tech news?

Yes, see for example https://techcrunch.com/2018/09/19/newegg-credit-card-data-br...

Re: Quora User Data Compromised

#498

Post by jwr »

bigtunacan wrote: post #121
jwr wrote: post #45

Earlier quoted context omitted.

Still, I would have thought it is good practice to notify your users if you leak their data to thieves. Quora did the right thing and should be applauded. As a counterexample, it seems that Newegg had a massive breach (thieves installed JavaScript that skimmed credit card numbers for weeks) in August, and even though my credit card was likely stolen, I hever heard about it from Newegg.

Not sure why you didn't hear from Newegg, but they did send out a mass email notification with details of the breach.

They did? I never got anything from them. And I was definitely within the time window.

Re: Quora User Data Compromised

#499

Post by ShinTakuya »

MattBearman wrote: post #273

I think at this point it should be standard practice to say what hashing algorithm is used in passwords when disclosing a breach. The email I got from quota just says “encrypted” passwords, and while the blog post says “hashed”, it doesn’t say what algorithm. For all we know it could be something useless like MD5

It'd be useful in the sense that you'd be able to warn others, but for your own password you should be using a password manager with auto generated random passwords. That way the only thing you need to do is change one password on the leaked site.

Re: Quora User Data Compromised

#500

Post by MichaelDickens »

rahimnathwani wrote: post #435

It's strange that: - the linked article says the breach included hashed passwords, but makes no mention of salt - the help page says they're forcing affected users to change their passwords If the passwords were salted before being hashed and stored, then: - Why not mention it, so users (especially those who don't use unique passwords on every site) know that it's not trivial for their password to be found? - Why for…

From the email that I received from Quora:

> the passwords were encrypted (hashed with a salt that varies for each user)

Looks like the article says the same thing.

Post reply on HN