Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quora User Data Compromised

blog.quora.com

Post reply on HN
Print view View original

61–70 of 525 posts

Re: Quora User Data Compromised

#61

Post by pgrote »

spydum wrote: post #28
beefsack wrote: post #14

Earlier quoted context omitted.

This is a healthy mindset to have. I feel that for every company that self-reports a leak, there are multiple other companies that have leaked your data and either haven't discovered the breach, refuse to disclose it, or flat out sold your data to the highest bidder.

You would be correct. In the US, which I might remind you, does not have a national law on the books regarding data breach notification. Even at the state levels, it’s varies pretty wildly on top of, most notifications are only required if there is evidence. So here is the challenge: what if I keep no logs, and have terrible security monitoring capability? If I am notified or discover a critical vulnerability on my o…

>In the US, which I might remind you, does not have a national law on the books regarding data breach notification.

Our federal government is beholden to corporations, so I don't see any legislation ever happening to punish nor place a regulatory significance on breaches.

If the Equifax debacle didn't move the needle, nothing will. How they didn't get a death penalty for not protecting one of the supports of our financial system I will never know.

As the parent said, I've just assumed all my data will be breached eventually. When it occurs I dutifully sign up for the monitoring offered and make sure to review things on a monthly basis.

Your comment on breach notification is spot on. WISH.COM has suffered down line breaches in their process and it is easy to prove by the use of virtual credit card numbers ... numbers that are generated and used at only one site. They have been silent when it is reported to them.

Re: Quora User Data Compromised

#62

Post by guscost »

hunter2_ wrote: post #53
guscost wrote: post #29

Earlier quoted context omitted.

Did a double take at this too, but they clarified that it means “hashed with a unique salt” later on. Not a good word choice for a summary though!

They do indeed, but then for some reason, they also say "this breach may have exposed ... the password you used" [0] which is a statement I think is wholly incompatible with the notion of "hashed with a salt that varies for each user" (but please let me know if I'm incorrect). They can rightfully say "encrypted" to a lay audience because the definition of encrypted is not so strict as to require decryptability, but w…

If the salts were stored with the passwords, it might be possible to brute-force any single (simpler) password by testing lots of salt+guess combinations. Salting only really protects against rainbow tables (pre-computed guesses for lots of passwords).

Re: Quora User Data Compromised

#63

Post by Pmop »

sharkweek wrote: post #6

At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping to provide individual companies with as little information about me as possible. The toughest ones here are my online banking and my online health portal, but other than that, I have gotten pretty picky about what information I give any company.

That being said, I wonder if it's a good idea to extend KeePass to generate full credentials for given website.

Re: Quora User Data Compromised

#64

Post by eridius »

bhauer wrote: post #31
aviv wrote: post #20

Earlier quoted context omitted.

I have an email address that I've only ever used as my AWS account email since many years ago. Somehow I started getting spam on it last year. It is not an address anyone could guess or somehow generate based on other data points such as name or otherwise.

Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist…

I would guess most companies are not in the business of selling their user email lists, but rather, shared the user's email with a third-party company that provided some service, and that third-party company then sold it.

Re: Quora User Data Compromised

#65

Post by toofy »

s3r3nity wrote: post #19

So I'm not a security expert, so I ask this in real earnest to learn: what is it that these companies keep doing wrong, and/or why aren't they adjusting to the climate that these types of attacks are increasing over time? Or are they trying to adjust, and the attacks are getting so sophisticated that the pace of investment in counter-measures is below that of the pace of advancement in the complexity of attacks? Or s…

It’s a whole lot of things, but first and foremost and probably the simplest explanation, security is hard. Incredibly hard.

Once you understand how difficult attack mitigation is, then you can pick and choose from a variety of factors:

- executives may not have a realistic understanding of how difficult attack mitigation is so they don’t allocate the resources for hiring

- incompetent admins overestimating their abilities

- competent admins who are underfunded

- incompetent admins who underestimate the value of the data they’re protecting

- competetent admins who may not have an accurate picture of what data they’re trying to protect so their threat model is flawed due to inaccurate information

- executives who are aware of how difficult mitigation is but don’t place customer data privacy as a priority.

- the current iteration of our growth obsessed corporate models unintentionally results in a race to the bottom in many ways.

- little incentive for companies to factor in social impacts as we don’t yet seem inclined to figure out a way to include impacts on society as one of the many metrics to measure a company’s success or failures.

It’s worth remembering though, even the most responsible, most well funded, most security conscious, and best staffed organizations have been compromised at one point or another—security is hard.

Re: Quora User Data Compromised

#66

Post by varenc »

hunter2_ wrote: post #53
guscost wrote: post #29

Earlier quoted context omitted.

Did a double take at this too, but they clarified that it means “hashed with a unique salt” later on. Not a good word choice for a summary though!

They do indeed, but then for some reason, they also say "this breach may have exposed ... the password you used" [0] which is a statement I think is wholly incompatible with the notion of "hashed with a salt that varies for each user" (but please let me know if I'm incorrect). They can rightfully say "encrypted" to a lay audience because the definition of encrypted is not so strict as to require decryptability, but w…

It's reasonable your password might be exposed since the attacker can now perform an offline brute force attack on the password hashes.

How likely it is your password gets brute forced really depends on the hash function used. If it's md5... all but the strongest password could be broken. (though at least the passwords were salted). If they're using something like bcrypt with a work factor of 10+, it's a different story and only the weakest passwords are at serious risk.

The fact that details on the hashing scheme aren't shared makes me assume it's not great...

Re: Quora User Data Compromised

#67

Post by dreyfiz »

I'm experiencing a sense of schadenfruede because I'm embittered by Quora's arrogant "real names" policy. They won't "let me" contribute.

Nothing insightful. I'm just here to kick them while they're down.

Re: Quora User Data Compromised

#68

Post by h1d »

sharkweek wrote: post #6

At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping to provide individual companies with as little information about me as possible. The toughest ones here are my online banking and my online health portal, but other than that, I have gotten pretty picky about what information I give any company.

You wouldn't know where the data goes to anyway even without any unintentional leaks. No need to provide more than necessary.

Re: Quora User Data Compromised

#69

Post by diego »

s3r3nity wrote: post #19

So I'm not a security expert, so I ask this in real earnest to learn: what is it that these companies keep doing wrong, and/or why aren't they adjusting to the climate that these types of attacks are increasing over time? Or are they trying to adjust, and the attacks are getting so sophisticated that the pace of investment in counter-measures is below that of the pace of advancement in the complexity of attacks? Or s…

In this particular case it doesn't seem too bad. Someone's name and address are not (or should not be) particularly sensitive information. Passwords are, and that's why best practices only keep a one-way function of the password ("encrypted" implies that it can be decrypted to plaintext, which should not be the case).

Luckily you can sign up for Quora with any name and email. You have to assume that no matter how hard a site tries to protect your info, it will get compromised sooner or later. The best they can do is what Quora does: demand as little info about you as they need.

Re: Quora User Data Compromised

#70

Post by monetus »

jwr wrote: post #45
spydum wrote: post #28

Earlier quoted context omitted.

You would be correct. In the US, which I might remind you, does not have a national law on the books regarding data breach notification. Even at the state levels, it’s varies pretty wildly on top of, most notifications are only required if there is evidence. So here is the challenge: what if I keep no logs, and have terrible security monitoring capability? If I am notified or discover a critical vulnerability on my o…

Still, I would have thought it is good practice to notify your users if you leak their data to thieves. Quora did the right thing and should be applauded. As a counterexample, it seems that Newegg had a massive breach (thieves installed JavaScript that skimmed credit card numbers for weeks) in August, and even though my credit card was likely stolen, I hever heard about it from Newegg.

How did you find out they did that? Just following tech news?
Post reply on HN