Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

At Blind, a security lapse revealed private complaints from tech employees

techcrunch.com

Post reply on HN
Print view View original

71–80 of 141 posts

Re: At Blind, a security lapse revealed private complaints from tech employees

#71

Post by dgzl »

free652 wrote: post #69
dgzl wrote: post #67

This bothers me: > The database also contained passwords, which were stored as an MD5 hash, a long-outdated algorithm that is nowadays easy to crack. Many of the passwords were easily unscrambled using readily available tools when we tried. That's not how hash functions work... > Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are…

The passwords were md5 hashed and most likely broken using dictionary attack or brute forced with tools like hashcat. I forgot my password once, but I knew the general letters and it brute forced in a minute.

Yeah weak hashes are easy to replicate, I was just laughing at the words they used.... Unscramble, like it's an encryption method or something.

Re: At Blind, a security lapse revealed private complaints from tech employees

#72

Post by blahblahblogger »

> Blind claims on its website that its email verification “is safe, as our patented infrastructure is set up so that all user account and activity information is completely disconnected from the email verification process.”

Wow a patented infrastructure! Dope!

I wonder if it's open source so that can be validated objectively?

Re: At Blind, a security lapse revealed private complaints from tech employees

#73

Post by chillacy »

mcpherrinm wrote: post #58
haditab wrote: post #55

Earlier quoted context omitted.

There's so much misinformation on it I find it hard to trust. I prefer to go with H1B salary databases.

H1B databases tend to underestimate. My entry in the database lists my starting salary from a few years ago, with no bonuses, options/rsus, or promotion/raises.

levels.fyi is pretty good since it has the bonuses and rsus, but sometimes it doesn't have everything if it doesn't fit into that structure

Re: At Blind, a security lapse revealed private complaints from tech employees

#74

Post by dgzl »

austincheney wrote: post #70
dgzl wrote: post #67

This bothers me: > The database also contained passwords, which were stored as an MD5 hash, a long-outdated algorithm that is nowadays easy to crack. Many of the passwords were easily unscrambled using readily available tools when we tried. That's not how hash functions work... > Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are…

> That's not how hash functions work... Kind of. A hash function just provides a near random set of characters of fixed length for a given set of input in a way where the output characters are reproducible for the given input. Passwords are not stored. It is the computed hash value that is stored. When a user attempts to login with a username and password the password is hashed and compared to the stored hash. That s…

> To the article's defense neither claim was verified, but both claims were reported. When the journalist cannot validate a claim themselves, or with experts, it is completely acceptable to report the claim and report the validation status.

The reporter says they successfully produced passwords, sounds clean-cut and dry to me.

Don't you think this is a pretty important claim to verify, instead of asserting without giving proof? Granted, if a dictionary attack gives you a bunch of 'password' variants, you probably don't need much more evidence.

If the reporter is so invested in producing this story, then being able to say "no, these are definitely passwords" in the face of the executive would be the golden ticket, right?

Re: At Blind, a security lapse revealed private complaints from tech employees

#75

Post by Novashi »

austincheney wrote: post #70
dgzl wrote: post #67

This bothers me: > The database also contained passwords, which were stored as an MD5 hash, a long-outdated algorithm that is nowadays easy to crack. Many of the passwords were easily unscrambled using readily available tools when we tried. That's not how hash functions work... > Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are…

> That's not how hash functions work... Kind of. A hash function just provides a near random set of characters of fixed length for a given set of input in a way where the output characters are reproducible for the given input. Passwords are not stored. It is the computed hash value that is stored. When a user attempts to login with a username and password the password is hashed and compared to the stored hash. That s…

>To be secure the salt must be stored in a different location from the stored hashes and the salt value should not be statically visible in the source code provided a source code compromise.

This is outdated though. You don't need to take extra steps to secure the salt if you move to a good hash.

Re: At Blind, a security lapse revealed private complaints from tech employees

#76

Post by Someone »

dgzl wrote: post #67

This bothers me: > The database also contained passwords, which were stored as an MD5 hash, a long-outdated algorithm that is nowadays easy to crack. Many of the passwords were easily unscrambled using readily available tools when we tried. That's not how hash functions work... > Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are…

“We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.”

So, they store your data securely, but that doesn’t matter, since they also stored it insecurely, and leaked the latter.

Re: At Blind, a security lapse revealed private complaints from tech employees

#77

Post by highesttide »

stef25 wrote: post #66
farazzz wrote: post #21

Earlier quoted context omitted.

Isn’t SHA2 the standard hashing algorithm? If not, what do people use now?

Back when I was a super junior php dev I stumbled across a post by Cal Henderson about using bcrypt https://www.iamcal.com/2012-06/use-bcrypt/ His lib is can be dropped in to any project (that doesn't have something similar built in already) https://github.com/iamcal/lib_bcrypt Anyone writing code has no excuse for not using this, it's not rocket surgery.

It's worth noting that the current standard encryption and password hashing in the php core is great, with no external dependencies added

Re: At Blind, a security lapse revealed private complaints from tech employees

#78

Post by angarg12 »

ineedasername wrote: post #17

I'd never checked out Blind before. I just went there and checked out a few of the front page posts & comments. It has some of the most toxic and destructive "advice" I've seen for people asking for help or insight. I'm a bit astounded. Is this typical?

The general tone of the discourse is so depraved that you can either cry or laugh. I choose the latter. The relationship advice is a particularly dirty source of entertainment.

Re: At Blind, a security lapse revealed private complaints from tech employees

#79

Post by RJIb8RBYxzAMX9u »

Novashi wrote: post #75
austincheney wrote: post #70

Earlier quoted context omitted.

> That's not how hash functions work... Kind of. A hash function just provides a near random set of characters of fixed length for a given set of input in a way where the output characters are reproducible for the given input. Passwords are not stored. It is the computed hash value that is stored. When a user attempts to login with a username and password the password is hashed and compared to the stored hash. That s…

>To be secure the salt must be stored in a different location from the stored hashes and the salt value should not be statically visible in the source code provided a source code compromise. This is outdated though. You don't need to take extra steps to secure the salt if you move to a good hash.

"Hashing" is unfortunately a very overloaded term. Even searching for "password hashing" gave me pretty bad results for the top hits. "Key derivation function" (KDF) gave much better results.

Re: At Blind, a security lapse revealed private complaints from tech employees

#80

Post by vonmoltke »

chillacy wrote: post #73
mcpherrinm wrote: post #58

Earlier quoted context omitted.

H1B databases tend to underestimate. My entry in the database lists my starting salary from a few years ago, with no bonuses, options/rsus, or promotion/raises.

levels.fyi is pretty good since it has the bonuses and rsus, but sometimes it doesn't have everything if it doesn't fit into that structure

levels.fyi only really works for companies that have large numbers of reports. The raw data has so many reporting inconsistencies that it's really hard to interpret for most companies.
Post reply on HN