Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers raid eBay in historic breach, access 145 million records

reuters.com

Post reply on HN
Print view View original

61–70 of 100 posts

Re: Hackers raid eBay in historic breach, access 145 million records

#61

Post by dchest »

nly wrote: post #59
dchest wrote: post #58

Earlier quoted context omitted.

It's true that if your browser and websites supported SRP-EC-Scrypt, you would know that they stored things "securely". However, this won't solve the problem of people using weak passwords and people using the same password for different websites. If you use strong passwords and don't reuse them, you already know your risks. As for your second point, I don't understand it. Do you mean, with the help of SRP, you can s…

> If you use strong passwords and don't reuse them, you already know your risks. Nobody does this. Geeks who use password management are are an extreme minority, and solutions like LastPass are crock that solve the same problem by papering over infrastructural failings and mean users are never completely free to move. Anecdotally I believe people typically use a 'good password' for banking etc, and a handful of lazy…

I agree with you that browsers help can improve security, in general. (Mozilla tried this with BrowserID/Persona, but failed.)

As for your second point, I still don't understand it :-) It's hard to make something usable without trusting servers in the current browser environment, even if browser vendors cooperate.

Re: Hackers raid eBay in historic breach, access 145 million records

#62

Post by nly »

dchest wrote: post #61
nly wrote: post #59

Earlier quoted context omitted.

> If you use strong passwords and don't reuse them, you already know your risks. Nobody does this. Geeks who use password management are are an extreme minority, and solutions like LastPass are crock that solve the same problem by papering over infrastructural failings and mean users are never completely free to move. Anecdotally I believe people typically use a 'good password' for banking etc, and a handful of lazy…

I agree with you that browsers help can improve security, in general. (Mozilla tried this with BrowserID/Persona, but failed.) As for your second point, I still don't understand it :-) It's hard to make something usable without trusting servers in the current browser environment, even if browser vendors cooperate.

> It's hard to make something usable without trusting servers in the current browser environment, even if browser vendors cooperate.

That's why the solution needs to be built in to web standards like HTTP 2.x and HTML, rather than shimmed in to a javascript library. The original HTTP authentication scheme actually did one thing right, and that was bypassing HTML and Javascript (where any hope of security and privacy is long dead and buried) and going straight to the browser UI.

Re: Hackers raid eBay in historic breach, access 145 million records

#63

Post by MasterScrat »

tombrossman wrote: post #48
dchest wrote: post #33

Earlier quoted context omitted.

Could you elaborate on that?

I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s). If the attackers got plaintext data (worst-case) and users re-used logins on other sites, it's a 'holy shit drop everything and change passwords now' moment. If Ebay followed best practices then affected users know they can wait a day or two and update passwords at a convenient time. Has…

If used properly, can't the good hashing techniques be "safe", at least if the salt is not leaked?

Re: Hackers raid eBay in historic breach, access 145 million records

#64

Post by dchest »

nly wrote: post #62
dchest wrote: post #61

Earlier quoted context omitted.

I agree with you that browsers help can improve security, in general. (Mozilla tried this with BrowserID/Persona, but failed.) As for your second point, I still don't understand it :-) It's hard to make something usable without trusting servers in the current browser environment, even if browser vendors cooperate.

> It's hard to make something usable without trusting servers in the current browser environment, even if browser vendors cooperate. That's why the solution needs to be built in to web standards like HTTP 2.x and HTML, rather than shimmed in to a javascript library. The original HTTP authentication scheme actually did one thing right, and that was bypassing HTML and Javascript (where any hope of security and privacy…

Could you give one usage example of such scheme if it was properly implemented?

Re: Hackers raid eBay in historic breach, access 145 million records

#65

Post by SixSigma »

dchest wrote: post #29
guelo wrote: post #23

Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?

You need to know how they store passwords because ... what?

if their scheme is secure, disclosure should not be an issue

Re: Hackers raid eBay in historic breach, access 145 million records

#66

Post by pjc50 »

nzonbi wrote: post #14

Billion dollar startup opportunity: un-hackable, secure databases as a service.

"Much more hacker resistant" authentication is certainly something you could sell as a service; but it's not cheap and nobody wants to pay for security.

Re: Hackers raid eBay in historic breach, access 145 million records

#67

Post by dchest »

MasterScrat wrote: post #63
tombrossman wrote: post #48

Earlier quoted context omitted.

I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s). If the attackers got plaintext data (worst-case) and users re-used logins on other sites, it's a 'holy shit drop everything and change passwords now' moment. If Ebay followed best practices then affected users know they can wait a day or two and update passwords at a convenient time. Has…

If used properly, can't the good hashing techniques be "safe", at least if the salt is not leaked?

Good hashing techniques store "salt" along with password. Salt is not a secret key, it's a public value used to make password hashes unique.

Good hashing techniques increase costs for attackers to brute-force passwords.

If they securely encrypted passwords or password hashes, and the key was not leaked, then passwords are safe. However, the probability of attackers stealing the database of passwords and not stealing the encryption key for it is pretty low.

Knowing anything of this still doesn't affect user actions, who should change eBay passwords and never reuse them for anything else.

Re: Hackers raid eBay in historic breach, access 145 million records

#69

Post by sgk284 »

dchest wrote: post #54
perlgeek wrote: post #49

Earlier quoted context omitted.

Many breaches in the past revealed that passwords were somehow "hashed" or "encrypted" in ways that made it much easier than necessary for the attacker to obtain the clear text passwords. For example if passwords are only hashed with md5, with no salt, that's basically worthless; md5 is simply too easy to brute force. Same for sha1 (not quite as easy to reverse, but rainbow tables help). So the mere fact that the pas…

I know that different password storage schemes provide different security. I don't see how knowing what particular scheme they used would affect your actions.

If you use a secure password and the scheme the company uses is something like scrypt or bcrypt with high work factors, you can be near-certain that your password won't be cracked by an attacker. The amount of computation is just extraordinary.

That said, you would still probably want to change your password if you're paranoid.

Re: Hackers raid eBay in historic breach, access 145 million records

#70

Post by dchest »

SixSigma wrote: post #65
dchest wrote: post #29

Earlier quoted context omitted.

You need to know how they store passwords because ... what?

if their scheme is secure, disclosure should not be an issue

Another reply that doesn't answer my question.

  Q: Why do you need to know how they store passwords?
  A: It's not an issue for them to disclose it.
What you gain by knowing their scheme? What you gain by knowing if it's secure or not?
Post reply on HN