The Ashley Madison Database Was Leaked • Hacker News Board

Re: The Ashley Madison Database Was Leaked

#71

Post by mehrdada » Wed, Aug 19, 2015, 5:49 AM UTC

revicon wrote: post #65

MarkMc wrote: post #63

Earlier quoted context omitted.

Well some of the passwords are safe. Bcrypt doesn't offer much protection if your password is on a list of the 10,000 most-common passwords [1]. Ashley Madison's highest priority should be to tell users to change their password on the Ashley Madison website, and any other website where they have used the same password . [1] http://www.passwordrandom.com/most-popular-passwords

Were the passwords salted as well? If so, the "commonness" of the password wont matter.

How so? Run bcrypt on 10000 most common password for each salt. Much easier than trying every password possible for each individual salt.

Re: The Ashley Madison Database Was Leaked

#72

Post by [deleted] » Wed, Aug 19, 2015, 5:55 AM UTC

caseysoftware wrote: post #26

That's the only way this can go. The company has three options: - Confirm that this (or any of the dumps) is the data. This almost definitely opens them up to lawsuits coming from a bunch of people who have little to lose. I say "little to lose" because a non-trivial number will be on the verge of divorce about to lose half of everything. - Keep their mouths shut and confirm/deny nothing. The press will continue on t…

[deleted]

Re: The Ashley Madison Database Was Leaked

#73

Post by venomsnake » Wed, Aug 19, 2015, 5:56 AM UTC

yeukhon wrote: post #25

This is my first time to learn about Ashley Madison. The business model actually disgusts me. I get the whole open relationship, but people who are actually married or in a committed relationship are using this site is just ridiculous. Either you break off with your current relationship, or stay loyal. BTW, those "secure" logo are just so useless I see them as sign of weakness rather than confidence. Anyone can place…

That line of thinking is nice when you are teen. But then the real world comes and people usually find that real life is more nuanced and complicated.

Lets start with - sex acts your SO just won't do, but you like them. A lot.

Re: The Ashley Madison Database Was Leaked

#74

Post by HSO » Wed, Aug 19, 2015, 6:01 AM UTC

dang wrote: post #16

tedunangst wrote: post #6

Earlier quoted context omitted.

We are never the infidels. Only "they" can be infidels.

Is there a word for things that only other people can be? The one that always comes to mind is "tourist".

Only they: terrorists

Only you: freedom fighter, liberator

Only they: imperialists

Only you: protector

Only they: baby killers

Only you: collateral damage

I'm sure George Carlin could come up with more expensive shots… Man, I miss him.

Re: The Ashley Madison Database Was Leaked

#75

Post by venomsnake » Wed, Aug 19, 2015, 6:01 AM UTC

Jipha wrote: post #62

ougachooga wrote: post #36

Earlier quoted context omitted.

I'm curious why so many are downvoting. Do you disagree that the business model is disgusting, or just think it's inappropriate to say so about a peer's startup? I'm very curious to know what HNers think about this.

From a business point of view, and like any company, they're matching a need with a service at a profit. But everyone has their own preferences and boundaries. Society generally frowns upon affairs, but if your own morals allow you to create that sort of business, it's your choice.

> Society generally frowns upon affairs

Than why is everyone doing it?

Re: The Ashley Madison Database Was Leaked

#76

Post by systematical » Wed, Aug 19, 2015, 6:03 AM UTC

Is there any information on how they were hacked? I'm more interested in how they were compromised than anything else.

Re: The Ashley Madison Database Was Leaked

#77

Post by dansingerman » Wed, Aug 19, 2015, 6:05 AM UTC

mehrdada wrote: post #71

revicon wrote: post #65

Earlier quoted context omitted.

Were the passwords salted as well? If so, the "commonness" of the password wont matter.

How so? Run bcrypt on 10000 most common password for each salt. Much easier than trying every password possible for each individual salt.

Bcrypt includes a (large) random salt so is not subject to rainbow table attacks. I believe therefore that will protect against identifying passwords contained in a known list.

If I'm wrong about this I'd love someone to explain why to me.

Re: The Ashley Madison Database Was Leaked

#78

Post by tajano » Wed, Aug 19, 2015, 6:05 AM UTC

cryowaffle wrote: post #51

First online checker that I found: https://ashley.cynic.al/

I can confirm it tested negative for negatives, and positive for a positive.

Re: The Ashley Madison Database Was Leaked

#79

Post by Natsu » Wed, Aug 19, 2015, 6:05 AM UTC

PhasmaFelis wrote: post #69

Natsu wrote: post #64

Earlier quoted context omitted.

It's been confirmed now by multiple sources.

The original article was specifically about the lack of concrete evidence, and didn't claim a definite answer until the update a couple of hours ago. The HN submission title had been changed before I posted, but Dang's explanation of the change posted about the same time as I did. I get it now, so by all means feel free to disagree with my original point about HN title etiquette, but please don't downvote me for fail…

FWIW, I upvoted you as I thought it was a bit harsh.

Re: The Ashley Madison Database Was Leaked

#80

Post by davb » Wed, Aug 19, 2015, 6:07 AM UTC

mehrdada wrote: post #71

revicon wrote: post #65

Earlier quoted context omitted.

Were the passwords salted as well? If so, the "commonness" of the password wont matter.

How so? Run bcrypt on 10000 most common password for each salt. Much easier than trying every password possible for each individual salt.

If they hashed PASSWORD + USER_SPECIFIC_SALT + SITE_SALT, storing USER_SPECIFIC_SALT in the user table and SITE_SALT in the application config, both data and site config would have to be leaked.