81–90 of 100 posts
Also, on the BBC news this morning (Thurs AM UK) a journalist seemed to hint that "passwords may or may not have been encrypted".
Earlier quoted context omitted.
if their scheme is secure, disclosure should not be an issue
Another reply that doesn't answer my question. Q: Why do you need to know how they store passwords? A: It's not an issue for them to disclose it. What you gain by knowing their scheme? What you gain by knowing if it's secure or not?
And yes, sorry, I was answering a different question to the one you asked.
An idea I had a while back - Build browser add-ons and a javascript site that performs N hashes of your master passphrase (high entropy) concatenated to the website domain (google, ebay, etc.). Set that hashed password to be your password on each website. Then when you use a computer you enter the master password and it generates all the domain-specific passwords. If that website is breached only the specific passwor…
Just changed it. I don't understand why eBay (and others) don't offer two-factor authentication. Of course this wouldn't have prevented the data theft but at least one can have a reasonable degree of certainty that your individual account will not be compromised with a simple password. I also strongly suggest that you change the answer to the one-and-only secret question to something completely unrelated. For example…
I don't understand why after a breach of this magnitude people continue to use a service, but just change their passwords and then move on.
Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?
Earlier quoted context omitted.
You need to know how they store passwords because ... what?
So we know how incompetent this rather large and famous company is, and how much we should trust them in the future. Being able to point and laugh is nice too, all seriousness notwithstanding.
(Laughing... yes, but people demanding, by law/at the gun point, to know which password scheme companies use is as far from fun as we can get.)
Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?
If the dump posted downthread is real- they are using pbkdf2-sha256, salted and 12000 rounds.
"Yaaay, we're now all safe, right?! No need to change passwords! Right, guys?"
An idea I had a while back - Build browser add-ons and a javascript site that performs N hashes of your master passphrase (high entropy) concatenated to the website domain (google, ebay, etc.). Set that hashed password to be your password on each website. Then when you use a computer you enter the master password and it generates all the domain-specific passwords. If that website is breached only the specific passwor…
Changing the master password will be a problem because you will have to update every site your have an account on.
Earlier quoted context omitted.
Another reply that doesn't answer my question. Q: Why do you need to know how they store passwords? A: It's not an issue for them to disclose it. What you gain by knowing their scheme? What you gain by knowing if it's secure or not?
In my country (UK), if it is not (reasonably) secure then they would be liable for prosecution. And yes, sorry, I was answering a different question to the one you asked.
1) People asking this question are eBay shareholders who are interested to learn if the company they own will be prosecuted by UK government for storing passwords insecurely; the fact of which was discovered after the leak of 145 million user records.
or
2) People asking this question are potential plaintiffs wanting to know if they should sue eBay for storing their password without hashing it with some hash function defined by law as secure.
Earlier quoted context omitted.
I don't understand why after a breach of this magnitude people continue to use a service, but just change their passwords and then move on.
What is the new eBay? That's a serious question too, not rhetoric.
http://jacquesmattheij.com/ripe-for-disruption
Ebay has been setting itself up for failure for a long time now, but I'm not surprised that people decided not to take on Goliath. But with this incident there might just be an opportunity to swing the scales in favour of a new entrant.