Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
What does it mean if you are a Zappos customer who did not get an email?
Zappos.com customer database compromised
81–90 of 93 posts
Re: Zappos.com customer database compromised
#82Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
I don't seem to be receiving the password reset email. I do use an email with a plus ("foo+bar@example.com") if that has any effect.
Re: Zappos.com customer database compromised
#83Earlier quoted context omitted.
Do you know what hash was used, if the passwords were salted and if so, if the salt is secure?
What do you mean by "the salt is secure"? Hidden in code files vs. stored next to the hashed password?
I apologize if my question was unclear; that's almost certainly because of a lack of expertise on my side.
On one end of the spectrum, I envision the same salt used for every user, allowing for the easy and effective creation of rainbow tables. On the other end, I envision unique salts with many bits of entropy for each user, making rainbow tables technologically infeasible.
Re: Zappos.com customer database compromised
#84Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
What does it mean if you are a Zappos customer who did not get an email?
All Zappos customers will be receiving the email linked to in this thread. If you haven't it might be in your spam folder or it might still be queued to go out. The link above is the same as the email contents.
Re: Zappos.com customer database compromised
#85Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
I don't seem to be receiving the password reset email. I do use an email with a plus ("foo+bar@example.com") if that has any effect.
Most likely your password reset email is in the queue to go out. Emails are slow to go out due to the massive volume of outgoing email we are trying to send out.
Re: Zappos.com customer database compromised
#86Earlier quoted context omitted.
It'd be cool if we could ship internationally. What would be even cooler is if we could inspire entrepeneurs in other countries to tackle it!
I'm in Chile as part of Start-Up Chile. What exactly do you need? PS - I am also a US customer. A block on international traffic effects more than just international customers.
Manpacks.com is a great example of a company that started up to fill the void left when Zappos stopped shipping to Canada.
Re: Zappos.com customer database compromised
#87Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
The email did not mention order history. Do you know if our personal order history was among the items compromised?
There really is no good news in this type of situation, but only the data items mentioned by Tony in the email above were compromised.
Re: Zappos.com customer database compromised
#88Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
Obviously in this kind of situation we (Zappos customers like myself) need to change any re-used passwords since the stolen unsalted hashes :( can be cracked. However, I have no idea which of several passwords I used at Zappos! I would normally just try logging in with each of them, but since you've reset all passwords, it looks like I won't be able to. Is there any chance of helping with this? I need to make sure it wasn't a password I use on any important sites (or derived from such a password).
I'm looking for the data dump right now, in case it was posted publicly--that's probably the only way I'll be able to answer my question since I doubt Zappos will cooperate :(
As someone who was just bit by the Stratfor data loss, this is the second month in a row. Fortunately my Stratfor password was worthless, but I had my credit card stolen and used to pay for video games. And now my email and street address are public information.
Re: Zappos.com customer database compromised
#89Earlier quoted context omitted.
Good job on not storing or sending clear text passwords. However, as others have indicated, we would like to know more about the hashing method used. As a side note, I was horrified to discover that Hertz sends passwords (as part of password recovery) in the clear. For those using Hertz, you should take the appropriate precautions.
I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. What are the best practices you want to see a website use when storing your password?
Salt. Seriously. A big, long, gnarly-looking salt. Preferably a unique salt per user. Really, even just that is sufficient, even if stored right next to the hash. It means doing a bruteforce/dictionary attack one user at a time rather than one bruteforce/dictionary attack of all the users at once (static salt) or just googling the hash (unsalted hash).
Also, are these passwords encrypted or hashed? Those two are miles away from each other and you guys are using both words nearly interchangeably. If encrypted, where is the key? Was it compromised?
Re: Zappos.com customer database compromised
#90Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
The email did not mention order history. Do you know if our personal order history was among the items compromised?
i'm picturing the blackmail note:
"dear bestnameever, i know about those high heels you bought, and i happen to know you don't have a girlfriend. $1000 in unmarked bills or we tell your father you're a cross-dresser."
Or the incredibly geeky wife who suspects her husband is showering the hot secretary with shoes and handbags, and confirms it by poring over the breached data.