61–70 of 93 posts
Page gives me : "We are so sorry – we are currently not accepting international traffic. If you have any questions please email us at help@zappos.com" Anyone could paste/screenshot/... what there is to see ?
You can check the URL http://viewtext.org/article?url=http://www.zappos.com/passwo... in case content changes/updates in that page.
Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
Good job on not storing or sending clear text passwords. However, as others have indicated, we would like to know more about the hashing method used. As a side note, I was horrified to discover that Hertz sends passwords (as part of password recovery) in the clear. For those using Hertz, you should take the appropriate precautions.
What are the best practices you want to see a website use when storing your password?
Earlier quoted context omitted.
> What would be even cooler is an API on top of LastPass that sites like Zappos could hook into to force a behind-the-scenes change of passwords How would Lastpass protect against an attacker masquerading as the third party website? (Especially considering this feature would be used when a website finds itself compromised.)
Maybe an API is an overkill in this case. Instead, a simple web service with a twist: Zappos has a private key and LastPass has the corresponding public key. Now, if Zappos.com is compromised and the breached is discovered and fixed, their CEO/CTO/head security guy grabs the private key and authenticates to LastPass, telling them that he is in fact who he says he is, and finally triggers the massive automatic passwor…
Still, the idea of a service for handling this makes sense. Rather than one based on a single vendor, a simple API for querying compromised domains would handle it. Then the lastpass extension can call that api for a list of the user's domains and see if anything needs to be changed. Being more general (just giving out information about recently compromised sites) also seems more useful, in that people would do a lot of different things with it.
Earlier quoted context omitted.
Good job on not storing or sending clear text passwords. However, as others have indicated, we would like to know more about the hashing method used. As a side note, I was horrified to discover that Hertz sends passwords (as part of password recovery) in the clear. For those using Hertz, you should take the appropriate precautions.
I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. What are the best practices you want to see a website use when storing your password?
Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
As a developer who fears these kinds of attacks on my own sites, is there anything you are able/allowed to reveal regarding how the attack happened, how it was discovered, and/or how it could be prevented?
Earlier quoted context omitted.
Good job on not storing or sending clear text passwords. However, as others have indicated, we would like to know more about the hashing method used. As a side note, I was horrified to discover that Hertz sends passwords (as part of password recovery) in the clear. For those using Hertz, you should take the appropriate precautions.
I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. What are the best practices you want to see a website use when storing your password?
Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
Do you know what hash was used, if the passwords were salted and if so, if the salt is secure?
Earlier quoted context omitted.
Good job on not storing or sending clear text passwords. However, as others have indicated, we would like to know more about the hashing method used. As a side note, I was horrified to discover that Hertz sends passwords (as part of password recovery) in the clear. For those using Hertz, you should take the appropriate precautions.
I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. What are the best practices you want to see a website use when storing your password?
That said, bcrypt and a time/attempt limited lockout should go a good ways in securing your site.
Good thing they didn't store passwords in clear-text!
Earlier quoted context omitted.
Just a precaution while we asses and deal with this. Zappos doesn't ship internationally so we hope this isn't affecting many customers. But to those that are, we apologize. As soon as we can we'll re-enable traffic from outside the US.
I for one would love Zappos to ship internationally, and your owners at Amazon already do. I know you can't comment, but please do what you can to push for selling to the other 6.7 billion of us.