Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quora User Data Compromised

blog.quora.com

Post reply on HN
Print view View original

511–520 of 525 posts

Re: Quora User Data Compromised

#511

Post by AlexB138 »

hellofunk wrote: post #337
IanSanders wrote: post #321

Earlier quoted context omitted.

Companies are not people and cannot have human attributes

Well, according to the US government, companies are in fact people for a wide variety of important purposes.

Repeating this is either willful misunderstanding of the law or parroting of outrage propaganda. We would all be much worse off if not for corporate personhood. There are aspects of it that are debatable (Citizens United ruling, which is the source of this tired meme), but without it you couldn't enforce contracts with a corporation after the employee who signed it left.

Re: Quora User Data Compromised

#512

Post by omnimus »

silasdavis wrote: post #203
jjoonathan wrote: post #104

Earlier quoted context omitted.

Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu item disappeared, bringing clicks-to-login from 1 to ~10. A few weeks ago I saw bitwarden finish their third party security audit and took the opportunity to jump. Couldn't be happier. Autofill fails less, the "copy password" menu works, the mobile experience…

LastPass is one of my least liked most used tools. Everything about the implentation feels second rate; slow, unreliable login capture, unreliable form fill, occasional inability to edit records, buried password copy, clunky UI, inappropriate modal nagging in browser and app... Most times I use it I am cursing it. I tried to switch to pass, and I'm not sure if it was something to do with how I imported but it didn't…

Bitwarden is best. I hope they will not get bankrupt from free users. Its funny it is cheapes but also works the best out off all managers i tried. Dashlane is good but its so much more expensive. Bitwarden will slowly kill most of the managers if they keep up the great work.

Re: Quora User Data Compromised

#513

Post by rahimnathwani »

MichaelDickens wrote: post #500
rahimnathwani wrote: post #435

It's strange that: - the linked article says the breach included hashed passwords, but makes no mention of salt - the help page says they're forcing affected users to change their passwords If the passwords were salted before being hashed and stored, then: - Why not mention it, so users (especially those who don't use unique passwords on every site) know that it's not trivial for their password to be found? - Why for…

From the email that I received from Quora: > the passwords were encrypted (hashed with a salt that varies for each user) Looks like the article says the same thing.

At the time I posted my comment, the web page said:

encrypted password (hashed)

Now it says:

encrypted password (hashed using bcrypt with a salt that varies for each user)

Re: Quora User Data Compromised

#514

Post by jiveturkey »

mehrdadn wrote: post #103
jedberg wrote: post #91

Earlier quoted context omitted.

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too. For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. A…

You could just use a normal Citi or BoA or any other card that generates virtual card numbers and that'll also lock it to that vendor after the first charge. So that they couldn't even hit it for $0.80 if they wanted to.

the real feature of privacy.com is the ability to use any address. who cares if your CC is compromised? get one just for recurring balances and another for everything else.

Re: Quora User Data Compromised

#515

Post by ryacko »

jiveturkey wrote: post #514
mehrdadn wrote: post #103

Earlier quoted context omitted.

You could just use a normal Citi or BoA or any other card that generates virtual card numbers and that'll also lock it to that vendor after the first charge. So that they couldn't even hit it for $0.80 if they wanted to.

the real feature of privacy.com is the ability to use any address. who cares if your CC is compromised? get one just for recurring balances and another for everything else.

Outside of the top ten SFW subscription services, they are all prone to being hacked.

Re: Quora User Data Compromised

#516

Post by gketuma »

silasdavis wrote: post #203
jjoonathan wrote: post #104

Earlier quoted context omitted.

Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu item disappeared, bringing clicks-to-login from 1 to ~10. A few weeks ago I saw bitwarden finish their third party security audit and took the opportunity to jump. Couldn't be happier. Autofill fails less, the "copy password" menu works, the mobile experience…

LastPass is one of my least liked most used tools. Everything about the implentation feels second rate; slow, unreliable login capture, unreliable form fill, occasional inability to edit records, buried password copy, clunky UI, inappropriate modal nagging in browser and app... Most times I use it I am cursing it. I tried to switch to pass, and I'm not sure if it was something to do with how I imported but it didn't…

Has anyone tried ButterCup (https://buttercup.pw/). I've been looking at the codebase and it seems really solid.

Re: Quora User Data Compromised

#517

Post by alexeldeib »

gketuma wrote: post #516
silasdavis wrote: post #203

Earlier quoted context omitted.

LastPass is one of my least liked most used tools. Everything about the implentation feels second rate; slow, unreliable login capture, unreliable form fill, occasional inability to edit records, buried password copy, clunky UI, inappropriate modal nagging in browser and app... Most times I use it I am cursing it. I tried to switch to pass, and I'm not sure if it was something to do with how I imported but it didn't…

Has anyone tried ButterCup ( https://buttercup.pw/ ). I've been looking at the codebase and it seems really solid.

This looks really nice. Wonder if there are any security reviews, I'm tempted to try it.

Re: Quora User Data Compromised

#518

Post by sundarurfriend »

mikeschmatz wrote: post #407
throwaway66666 wrote: post #287

In 2013 a quora moderator contacted me and demanded that I provide my real name, and information that my name is real or they would ban my account. I tried reasoning with them, that I just wanted to view content and did not attend to write answers or interact etc, plus, they had a valid email address and facebook profile (also fake name on facebook). They fought back "we actually want proof of your real name like a s…

> I tried reasoning with them, that I just wanted to view content and did not attend to write answers or interact etc, plus, they had a valid email address and facebook profile (also fake name on facebook). They fought back "we actually want proof of your real name like a scan of ID". I danced around and did not end up giving them a scan of my id, but I changed it to my real name. I don't understand why you bothered…

This is exactly what I did. I had even provided my real name already, it just didn't fit in the Western firstname-lastname format that they assumed everyone had, and so they disabled my account. I tried showing them that this was the cultural norm here, but they wanted a govt ID scan to "prove" it - all for a glorified social network.

Instead, I created a new email ID, gave a fake name, and registered with that. I gave up on the site soon anyway, but now I'm glad they forced me into registering with fake details.

Re: Quora User Data Compromised

#519

Post by baxtr »

jacquesm wrote: post #78

This is why I hate companies that force you to sign up to gain access to content. I do not want that relationship. Sooner or later those systems will be legacy and then maintaining them will be a pain. Bitrot will set in and sooner or later there will be a breach. One new development is that you used to be able to get your invoices mailed via snail mail. Then that disappeared and you got your invoices mailed via emai…

Some thoughts cross my mind:

- what doesn’t get hacked? Isn’t life a continuous trade-off between risks and chances

- If you’re afraid you’ll expose private information, then just don’t use a platform like that?

- these platforms use user generated content, true. But they provide the platform and the product. I think that is a fair deal.

Re: Quora User Data Compromised

#520

Post by MattBearman »

ShinTakuya wrote: post #499
MattBearman wrote: post #273

I think at this point it should be standard practice to say what hashing algorithm is used in passwords when disclosing a breach. The email I got from quota just says “encrypted” passwords, and while the blog post says “hashed”, it doesn’t say what algorithm. For all we know it could be something useless like MD5

It'd be useful in the sense that you'd be able to warn others, but for your own password you should be using a password manager with auto generated random passwords. That way the only thing you need to do is change one password on the leaked site.

That's exactly my point. I use 1password to handle my logins, but most people I speak to use the same password for everything, so knowing how likely it is that other services could be compromised due to this is vital.
Post reply on HN