Zappos.com customer database compromised • Hacker News Board

Re: Zappos.com customer database compromised

#71

Post by lelele » Mon, Jan 16, 2012, 11:45 AM UTC

rationalbeats wrote: post #47

forensic wrote: post #42

Earlier quoted context omitted.

FFS! It wasn't compromised, not remotely. The incident last year is what convinced me I could trust last pass.

Well they said that their database was compromised and they were not sure what was accessed. So I stopped using them after that incident. It was a while ago I don't remember the particulars, but I do remember they said they were not sure if someone stole everyones password so everyone should change their master password to be safe. So I deleted my account to be safer.

So what? As long as your master password was strong, your data was safe.

Re: Zappos.com customer database compromised

#72

Post by tvaughan » Mon, Jan 16, 2012, 12:24 PM UTC

jjacobson wrote: post #50

lancewiggs wrote: post #37

Earlier quoted context omitted.

I for one would love Zappos to ship internationally, and your owners at Amazon already do. I know you can't comment, but please do what you can to push for selling to the other 6.7 billion of us.

It'd be cool if we could ship internationally. What would be even cooler is if we could inspire entrepeneurs in other countries to tackle it!

I'm in Chile as part of Start-Up Chile. What exactly do you need? PS - I am also a US customer. A block on international traffic effects more than just international customers.

Re: Zappos.com customer database compromised

#73

Post by Deestan » Mon, Jan 16, 2012, 12:47 PM UTC

jjacobson wrote: post #62

newman314 wrote: post #57

Earlier quoted context omitted.

Good job on not storing or sending clear text passwords. However, as others have indicated, we would like to know more about the hashing method used. As a side note, I was horrified to discover that Hertz sends passwords (as part of password recovery) in the clear. For those using Hertz, you should take the appropriate precautions.

I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. What are the best practices you want to see a website use when storing your password?

> I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question.

The only way it could be harmful to disclose the hashing method is if you're using an insufficient one.

Re: Zappos.com customer database compromised

#74

Post by martingordon » Mon, Jan 16, 2012, 1:05 PM UTC

IgorPartola wrote: post #25

LastPass FTW! The attacker will reverse my password just to find a bunch of unusable bits :). What would be even cooler is an API on top of LastPass that sites like Zappos could hook into to force a behind-the-scenes change of passwords, similar to revoking a compromised certificate. Essentially, since there is some lead time after the breach is discovered and before the attacker manages to crack the long, random pas…

I used to have three different passwords of varying complexity that I shared across sites.

When Gizmodo's database was compromised and I didn't know which password I used there, I decided to stop using the same set of passwords everyone and started generating and storing my passwords using 1Password. It's a little annoying to use on my iPhone (particularly having to type my long master password on the soft keyboard), but it's dead simple to use on the desktop and I recommend it to everyone. I still have some sites that use my old passwords, but 1Password's Smart Folders let me search my passwords for those and I plan on changing those today.

(I haven't used LastPass so I can't comment on how it compares to 1Password)

Re: Zappos.com customer database compromised

#75

Post by listrophy » Mon, Jan 16, 2012, 2:13 PM UTC

jjacobson wrote: post #62

newman314 wrote: post #57

Earlier quoted context omitted.

Good job on not storing or sending clear text passwords. However, as others have indicated, we would like to know more about the hashing method used. As a side note, I was horrified to discover that Hertz sends passwords (as part of password recovery) in the clear. For those using Hertz, you should take the appropriate precautions.

I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. What are the best practices you want to see a website use when storing your password?

MD* - No, SHA* - No, Bcrypt - Yes!, Scrypt - Not yet (PDI). Make sure you also calibrate the work factor for Bcrypt, too. Then, write a blog entry about your findings.

Re: Zappos.com customer database compromised

#76

Post by [deleted] » Mon, Jan 16, 2012, 3:47 PM UTC

stickfigure wrote: post #46

jjacobson wrote: post #13

Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.

Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help. Can you provide any further information that would be of interest to HN readers? If not, why do you bother posting this?

[deleted]

Re: Zappos.com customer database compromised

#77

Post by mike-cardwell » Mon, Jan 16, 2012, 3:51 PM UTC

forensic wrote: post #42

rationalbeats wrote: post #39

Earlier quoted context omitted.

Except when LastPass was compromised last year...

FFS! It wasn't compromised, not remotely. The incident last year is what convinced me I could trust last pass.

There was also the XSS flaw in Feb last year that allowed an attacker to retrieve your email address, your password reminder, the list of sites you log into and the history of your logins, including which sites you logged into, the time and dates you logged into them, and the IP addresses you logged in from.

https://grepular.com/LastPass_Vulnerability_Exposes_Account_...

Their reaction to this flaw was exemplary though, and LastPass is a lot more secure now because of it.

Re: Zappos.com customer database compromised

#78

Post by karambahh » Mon, Jan 16, 2012, 3:51 PM UTC

pilsetnieks wrote: post #70

lancewiggs wrote: post #37

Earlier quoted context omitted.

I for one would love Zappos to ship internationally, and your owners at Amazon already do. I know you can't comment, but please do what you can to push for selling to the other 6.7 billion of us.

Javari (javari.co.uk) is another shoe store owned by Amazon and they do ship internationally (free within EU and Ireland)

I think they developed Javari in most of their European markets and logistics are handled by Amazon themselves.

Zappos is operated completely separately from Amazon so in order to expand internationally they would have to roll their own operations internationnaly.

Re: Zappos.com customer database compromised

#79

Post by travisp » Mon, Jan 16, 2012, 4:00 PM UTC

skrish wrote: post #17

+1 for not storing clear text passwords. I like the tone of the blog & how forthright they have been with dealing with the issue.

While they do get "+1" for this, they haven't provided any further details of what exactly they did with the passwords. Did they use a salt? Was the hashing algorithm MD5, bcrypt, or something else? If they used MD5 with no salt, your password may not be much more secure than a clear text password unless it's particularly complex.

Re: Zappos.com customer database compromised

#80

Post by reidmain » Mon, Jan 16, 2012, 4:25 PM UTC

martingordon wrote: post #74

IgorPartola wrote: post #25

LastPass FTW! The attacker will reverse my password just to find a bunch of unusable bits :). What would be even cooler is an API on top of LastPass that sites like Zappos could hook into to force a behind-the-scenes change of passwords, similar to revoking a compromised certificate. Essentially, since there is some lead time after the breach is discovered and before the attacker manages to crack the long, random pas…

I used to have three different passwords of varying complexity that I shared across sites. When Gizmodo's database was compromised and I didn't know which password I used there, I decided to stop using the same set of passwords everyone and started generating and storing my passwords using 1Password. It's a little annoying to use on my iPhone (particularly having to type my long master password on the soft keyboard),…

This is exactly what I do and I've switch friends and family over as well.

Whenever they bring up the perceived inconvenience (which goes down on the desktop with practice) I simply remind them how much time they will waste if one of their accounts is compromised.

Sure their foursquare (or pick another random service that doesn't hold EXTREMELY important data) account isn't that important but when it uses their Gmail address and has the same password they are just begging for trouble.

Also this gets them out of logging on to their Gmail and Facebook accounts from public computers. They still don't fully understand the possible problems but at least now it is such an inconvenience they just use their own devices.