Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Knuddels: Chat platform must pay after hacker attack fine

tellerreport.com

Post reply on HN
Print view View original

81–90 of 125 posts

Re: Knuddels: Chat platform must pay after hacker attack fine

#81

Post by johannes1234321 »

rocqua wrote: post #78
johannes1234321 wrote: post #61

Earlier quoted context omitted.

Even the threat of death penalty doesn't stop crimes. True, if there is no punishment and a threat is teethless nobody acts on it (that's why the big GDPR outcry also came only this year after the two year introductory phase) However if you have too high fines what happens s that companies try everything to hide the fault and lie to avoid the fines. Here a company complied to all things, improved security (which acco…

There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. Some examples of economic crime would be: not implementing security, tax fraud, overweight freight trucks; speeding to make a delivery on time (whilst on the clock). The first kind of crime is generally made by people who 'know they are wrong, but they feel like they don't…

I used the introductory example in response to the request of "extremely punitive" fines. Extreme fines lead to companies trying to be clever in hiding their faults. Moderate fines more likely lead to companies coming out by themselves.

On the comparison with overweight trucks: I doubt anybody builds an insecure system to gain an economical benefit, not using state-of-the-art technology is a mistake/stupidity/carelessness/.... "See how much money we earned from saving CPU time of bcrypt!" nobody said.

Re: Knuddels: Chat platform must pay after hacker attack fine

#82

Post by heavenlyblue »

johannes1234321 wrote: post #32
heavenlyblue wrote: post #25

Earlier quoted context omitted.

But which proves that access to the website codebase will grant you access to those passwords.

Access to the code base, gives you access to the login form. And gives access to all data.

I did not imply you can change the codebase, by the way.

Re: Knuddels: Chat platform must pay after hacker attack fine

#83

Post by heavenlyblue »

folkrav wrote: post #63
heavenlyblue wrote: post #25

Earlier quoted context omitted.

But which proves that access to the website codebase will grant you access to those passwords.

It's a matter of storing it in plaintext or not, which any sane developer knows not to. The codebase will always have access to your plaintext password at one point or another, whether it's on signup before they hash and store it, or when you login before comparing hashes. If someone has access to your codebase you've got bigger problems than plaintext passwords anyway.

>> If someone has access to your codebase you've got bigger problems than plaintext passwords anyway.

You're joking, right? The context of the discussion is when your database is already leaked. Then the chance is that your e-mail database is leaked, too. You may leak code, too. It doesn't necessarily mean someone can execute arbitrary code on your server though, yet.

Re: Knuddels: Chat platform must pay after hacker attack fine

#84

Post by heavenlyblue »

Arnt wrote: post #36
heavenlyblue wrote: post #25

Earlier quoted context omitted.

But which proves that access to the website codebase will grant you access to those passwords.

No. I've implemented precisely that and it doesn't prove what you think. What you do is have one single function create the user, pick a random password, set it in the database (which in my case uses a perfectly sensible hash) and send the user email. The cleartext password in the mail comes from the function's local string variable, not from the database. Whether doing this is a good idea is another question. IMO it…

>> No. I've implemented precisely that and it doesn't prove what you think.

Well, the way I read the parent is that you can request a previously set password to be sent to your e-mail.

Re: Knuddels: Chat platform must pay after hacker attack fine

#85

Post by arayh »

Double_a_92 wrote: post #40
tyingq wrote: post #15

"Knuddels is safer than ever." Corporate speak is just so funny. The bar for "safer than ever" is pretty low when your dev team hasn't heard of password hashing.

The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...

This sounds dumb. So if my password was "something" (yes, it's a terrible password), it would just keep censoring that word every time I write that into the chat?

Re: Knuddels: Chat platform must pay after hacker attack fine

#86

Post by majewsky »

tyingq wrote: post #72
kurtisc wrote: post #65

Earlier quoted context omitted.

IME banks often have poor security. And why not? They managed to rebrand robbery as identity fraud.

It's just infuriating, because credit card companies are the ones behind, for example, PCI. Which has guidance like: "8.4 Render all passwords unreadable during transmission and storage on all system components using strong cryptography"

This requirement is technically fulfilled by encrypting transmissions with TLS and storage with disk encryption like LUKS or Veracrypt. It does not really say anything about password hashing.

Re: Knuddels: Chat platform must pay after hacker attack fine

#87

Post by whyever »

invisiblea wrote: post #38
dorianm wrote: post #7

Full list of 5000+ websites that store their passwords in plain text: https://github.com/plaintextoffenders/plaintextoffenders/blo...

That list is very out of date. One of my clients appears on there and when we took over in 2012 we encrypted all their user credentials.

Their FAQ [1, 2] suggests that using an encrypted password still warrants an entry.

[1] http://plaintextoffenders.com/faq/devs

[2] http://plaintextoffenders.com/faq/non-devs

Re: Knuddels: Chat platform must pay after hacker attack fine

#88

Post by _8j50 »

judge2020 wrote: post #53
ygra wrote: post #22

Earlier quoted context omitted.

Well, you can work your way up with ever increasing levels of safety by adding first MD5, then moving to SHA-1, then adding a salt, and eventually something sensible like bcrypt. That's four more press releases right there :-)

And then you can claim "industry-leading encryption" when moving to argon2.

Is argon2 NIST approved? Can't say "military grade encryption" otherewise. /S

Re: Knuddels: Chat platform must pay after hacker attack fine

#89

Post by tyingq »

majewsky wrote: post #86
tyingq wrote: post #72

Earlier quoted context omitted.

It's just infuriating, because credit card companies are the ones behind, for example, PCI. Which has guidance like: "8.4 Render all passwords unreadable during transmission and storage on all system components using strong cryptography"

This requirement is technically fulfilled by encrypting transmissions with TLS and storage with disk encryption like LUKS or Veracrypt. It does not really say anything about password hashing.

The screenshot shows that the plaintext password was sent over SMTP. So it isn't meeting that bar either.

Re: Knuddels: Chat platform must pay after hacker attack fine

#90

Post by _8j50 »

Double_a_92 wrote: post #40
tyingq wrote: post #15

"Knuddels is safer than ever." Corporate speak is just so funny. The bar for "safer than ever" is pretty low when your dev team hasn't heard of password hashing.

The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...

Why didn't they just hash all the words they type if you must(maybe bloom filter?)
Post reply on HN