Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tuts+ Premium Account Security Compromised

notes.envato.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: Tuts+ Premium Account Security Compromised

#51

Post by pawelwentpawel »

pwny wrote: post #9

Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my own, how hard can it be? Getting hacked happens, even to the best but come on, how many times will we have to read blog posts like this one before people wake up? How hard can it be to hash and salt your passwords? Glad I wasn't one of their customers (and nev…

"Our current Tuts+ Premium app makes use of a third party plugin that unfortunately stores passwords in cleartext (i.e. unencrypted)."

"(...) with a plan currently in progress to upgrade away from the current plugin."

Oh, it's the plugin fault. Not theirs. Blame it on the plugin.

Re: Tuts+ Premium Account Security Compromised

#52

Post by yock »

nulluk wrote: post #33
jgrahamc wrote: post #20

We should start a new award for web sites with crap password security. Let's name it after Robert Morris (Senior) who essentially inventing password hashing. A Morris Award would be a bit like a Darwin Award for people who've failed to learn anything about password security and in doing so have been exposed. Recent Morris Award winners: LinkedIn, last.fm, eHarmony, Tuts+, ...

I have talked about & mentioned something similar before but bundeling the whole thing into a browser extension. Every site you hit gets checked against a local list thats periodically updated. It throws up an information bar with bad security practices associated with the site you are browsing, everything from mailing plaintext password to the idiotic things like above. If it becomes trusted enough it might move som…

Another criteria, perhaps...

My wife loves to use Big Oven to find recipe ideas. I thought I'd also start using it so we could share those ideas more easily. When they rejected my password for having "invalid special characters" however...

Re: Tuts+ Premium Account Security Compromised

#53

Post by ineedtosleep »

mnicole wrote: post #26
stef25 wrote: post #22

Earlier quoted context omitted.

And it's a company that teaches web development ...

Serious question; all of these tutorial sites.. are any of them a reliable source for web dev or are they just another Smashing Magazine where people get paid to write about things they don't understand?

IMO, Smashing is mostly typical blogspam with very occasional nuggets of good content. If you browse HN and some of the Reddit web/programming subreddits even somewhat frequently, both Smashing and tuts+ are pretty useless.

Re: Tuts+ Premium Account Security Compromised

#54

Post by matdes »

I alerted them to the fact that their passwords were in plaintext a YEAR AGO. I got a response email on June 29, 2011 saying:

"Thanks for reporting the issue of plain text passwords to us. It's how passwords are handled with the membership software we use for Tuts+ Premium, which isn't extremely well coded and something we want to rebuild from scratch. In the mean-time our dev team will be hacking the software to bring password security up to the best practices we advocate on our Tuts+ sites, like Nettuts+."

Not only was this issue brought up to them, they stated very clearly that they were working to bring their password security up to best practices. In a YEAR, they couldn't hack on a password hash or rebuild their plugin from scratch?

If anyone knows if there is a lawsuit pending that could use my email as evidence, please let me know.

Re: Tuts+ Premium Account Security Compromised

#55

Post by flyswatter »

jgrahamc wrote: post #20

We should start a new award for web sites with crap password security. Let's name it after Robert Morris (Senior) who essentially inventing password hashing. A Morris Award would be a bit like a Darwin Award for people who've failed to learn anything about password security and in doing so have been exposed. Recent Morris Award winners: LinkedIn, last.fm, eHarmony, Tuts+, ...

I think for impact there should be one grand winner each year. Otherwise there will soon be too many to count I'm afraid.

Maybe also an award for most silly password policy?

Re: Tuts+ Premium Account Security Compromised

#56

Post by dutchbrit »

My email to Envato:

I seriously can't understand how Envato found it responsible to even implement something that saves plaintext passwords. You must of known when inplementing it. If this "3rd party" plugin was so important, then implement the plugin later on when it is secure - you don't fuck around with private details. If it was important for the initial release, you shouldn't of launched until this was sorted.

You have hereby lost a customer. I now have to reset my password on a ton of forums and probably also themeforest. I will give you some other feedback. Maybe I'm blind but to login on Nettuts, don't make users have to scroll and look for a dinky login text.

On ThemeForest, seriously remove the fucking Captcha from the login form. Sorry for my French but seriously, on a contact or registration form, I could understand why. If you are afraid of brute force, there are other great ways to do so.

Fail, Sam Granger

Ps. You should read your own tutorials on security, they aren't too bad.

Re: Tuts+ Premium Account Security Compromised

#57

Post by sp332 »

bluetidepro wrote: post #4

This is ridiculous. In the email I received from Envato it says the following: "-- What To Do (1) Update passwords on ANY service you use that uses the same password as you had on Tuts+ Premium. (2) In particular you should consider your own email account, PayPal, Moneybookers, and other payment services. These are the most sensitive targets, and if you had the same password, you should consider this an urgent priori…

If you have Firefox, use the Password Reuse Visualizer. https://addons.mozilla.org/en-US/firefox/addon/password-reus... Then realize that if any of these sites get hacked, the attacker now has access to all the sites connected to it (using the same password).

Re: Tuts+ Premium Account Security Compromised

#59

Post by tedivm »

dutchbrit wrote: post #56

My email to Envato: I seriously can't understand how Envato found it responsible to even implement something that saves plaintext passwords. You must of known when inplementing it. If this "3rd party" plugin was so important, then implement the plugin later on when it is secure - you don't fuck around with private details. If it was important for the initial release, you shouldn't of launched until this was sorted. Y…

Why would you have to change your password on "a ton of forums" if you yourself have been using password best practices? Envato was responsible in their disclosure- you think those "tons" of forums are all going to do the same? For all you know your password has been in the wild for years.

You should use this as an opportunity to get a password manager (Lastpass, for instance) and use unique passwords for each site.

Re: Tuts+ Premium Account Security Compromised

#60

Post by mnicole »

ineedtosleep wrote: post #53
mnicole wrote: post #26

Earlier quoted context omitted.

Serious question; all of these tutorial sites.. are any of them a reliable source for web dev or are they just another Smashing Magazine where people get paid to write about things they don't understand?

IMO, Smashing is mostly typical blogspam with very occasional nuggets of good content. If you browse HN and some of the Reddit web/programming subreddits even somewhat frequently, both Smashing and tuts+ are pretty useless.

Yeah, I'm still trying to find the good dev subreddits. You get downvoted in /r/webdesign over some really pathetic crap but it seems to be the most active - any suggestions?
Post reply on HN