Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

ieeelog.com

Post reply on HN
Print view View original

81–90 of 138 posts

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#81

Post by fromhet »

This is without doubt terrible, we all know that. But it is not uncommon that web services leak passwords, so common that we are quite accustomed to it and expect it to happen from time to time.

This is not the right way to deal with the problem.

Authentication security for cloud services should be something that sits in the browser, not (only) on the server. This is done by 2factor auth, but that too relies too much on the server admin being good with security.

Maybe one solution would be that the router everyone has at home doubles as file server, and that all webapps files are stored there instead on the remote server? That would move the responsibility away from web devs (who often behave irresponsibly) to the ones writing the os for the router.

There are of course many ideas that are better than mine, but to let web devs have control of this is evidently not a good one. Something needs to change.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#82

Post by shakesbeard »

batista wrote: post #77
ZoFreX wrote: post #46

Earlier quoted context omitted.

> It obviously won't help if your database is compromised Good news, everyone: it will!

No, it won't. They can just write a new password + salt in the db and get in as that user.

But maybe that's not want you want to achieve?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#83

Post by pjscott »

Pyroshock wrote: post #61
ghshephard wrote: post #48

Earlier quoted context omitted.

One of these days we will shut down the "Salting password hashes is a useful thing to do." meme from 1994. See: http://codahale.com/how-to-safely-store-a-password/ for details.

There's a reason key derivation functions like PBKDF2 and bcrypt still require a salt as an input.

And there's a reason why high-level libraries like bcrypt handle salt generation and storage internally: if they didn't, people would screw it up. It's amazing how many people blithely use some crazy scheme like

    pwhash = md5("this is my salt" + password)
Progress in password hashing security is primarily progress in making things trivially foolproof and then hectoring people into using them.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#84

Post by pjscott »

vegardx wrote: post #65
trekkin wrote: post #64

Properly hashing/salting passwords on the client (in JavaScript) is more or less a must now. Client-side encryption is the next logical step. Although not perfect, it is better than storing plaintext data on the server.

It's a horrible solution. Just store them hashed on the server end, and make a secure connection. I would argue that more browsers support SSL than JavaScript...

Agreed. I see three possibilities:

1. The server is non-malicious and competently written. The passwords are correctly hashed with something like bcrypt or scrypt. (This is super-easy, so server programmers have no excuse for not doing this.) Browser-side hashing has no advantage.

2. The server is non-malicious, but incompetently written, e.g. they store plaintext passwords or some crap like that. Hashing passwords in javascript would help, but it's not as good as fixing the server, and almost certainly a lot harder.

3. The server is malicious. In which case it can serve up malicious javascript, so you're just as screwed.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#85

Post by runn1ng »

kree10 wrote: post #52
fmavituna wrote: post #40

Earlier quoted context omitted.

d) To not keep 100K users' passwords in a public FTP server :)

I'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?

If you want to have a shared folder that you share between people you trust, it's still the simplest solution. It's very low-level, but it works.

Yes, you can buy a cloud offering, but physical disk is still way cheaper than "cloud disk". You don't have all the cloud features, but on the other hand, the data are 100% yours, on a server that you control.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#86

Post by runn1ng »

shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

OK, please educate me. (Take me as a model web developer.)

I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities.

I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#87

Post by stusmall »

kree10 wrote: post #52
fmavituna wrote: post #40

Earlier quoted context omitted.

d) To not keep 100K users' passwords in a public FTP server :)

I'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?

I usually have an internal TFTP server set up and laying around somewhere. A lot of embedded devices provide simple support for updating their firmware over TFTP.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#88

Post by EvanAnderson »

runn1ng wrote: post #85
kree10 wrote: post #52

Earlier quoted context omitted.

I'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?

If you want to have a shared folder that you share between people you trust, it's still the simplest solution. It's very low-level, but it works. Yes, you can buy a cloud offering, but physical disk is still way cheaper than "cloud disk". You don't have all the cloud features, but on the other hand, the data are 100% yours, on a server that you control.

I don't buy that it's "the simplest". Just about every major Linux distro ships w/ SFTP enabled out-of-the-box. How is installing an FTP server easier than just using the built-in SFTP server?

I've been trying to actively discourage the use of FTP for the last 10+ years. It's not an option because it passes passwords in-the-clear. Protocols that pass cleartext authentication should just be off the table today.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#89

Post by gibybo »

CamperBob2 wrote: post #75

OT, but why in God's name do some people/countries feel it appropriate to use periods rather than commas as a thousands separator? Do these people just want to cause industrial disasters, medical errors, zombie uprisings, and lost planetary probes?

Maybe those people/countries think the same about people using the comma as a thousands separator instead of a decimal?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#90

Post by superprime »

runn1ng wrote: post #86
shanemhansen wrote: post #29

I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum. Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsi…

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

You can use mod_ssl: http://onlamp.com/onlamp/2008/03/04/step-by-step-configuring... . Other good resources are an easy search away.

There are basically two steps, both of which can be at no additional cost:

1. get a certificate, and

2. configure your server to use the certificate.

You can generate a certificate yourself, without paying anyone, and it will work fine, but some browsers will throw up a warning page if it is not signed by an authority (more: http://www.namecheap.com/support/knowledgebase/article.aspx/...).

Post reply on HN