Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers raid eBay in historic breach, access 145 million records

reuters.com

Post reply on HN
Print view View original

91–100 of 100 posts

Re: Hackers raid eBay in historic breach, access 145 million records

#91

Post by msderosa »

With eBay's response to date, there is very little information that allows users to better evaluate a service in which they have invested trust. Questions of trust and safety are natural for people to raise in a variety of everyday circumstances. For example, when people get on a plane or take medicine its natural for them to be concerned about the safety. In eBay's case, eBay is a market place and a financial services company so it's reasonable to ask for high standards and to question what their security practices are like.

One would also think that eBay would have a strong interest in developing trust between themselves and their customers, but there is little evidence of that recognition. Specifically, the going corporate standard for a major security breach among eBay's corporate peers is (a) full and (b) immediate disclosure.

By (a) full, note, that eBay has come our with a very murky statement about exactly what happened. There is nothing more substantial than "you should change your password but we don't think there is any danger". Well, was there general database access? Did attackers had access to production servers? All of them? Is there any impartial 3rd party audit that stands behind eBays security statements? Further, as part of a full disclose, it's good procedure to disclose how passwords were stored if they expect to establish trust. They have had 2 weeks at least to prepare their statements and they can't do better than the useless "passwords were encrypted"?. There are really only two possibilities here: (1) passwords were combined with a random salt and then hashed or (2) they were morons. And right now given their public statement it looks like (2).

By (b) immediate, note, its not unreasonable to expect that a certain percentage of eBay's users use the same username / password for both their eBay and their PayPal accounts. So for a couple of weeks now eBay has been aware of a potential financial danger to their customers and they have been sitting on the problem. Fail.

Security breaches happen to everyone. There is no faulting eBay there. The fault is with all aspects of their response. They have had a major security breach and they have not responded with a proportional disclosure. And that implies that security isn't their largest company problem.

Re: Hackers raid eBay in historic breach, access 145 million records

#92

Post by robomartin »

watersb wrote: post #42
robomartin wrote: post #22

Just changed it. I don't understand why eBay (and others) don't offer two-factor authentication. Of course this wouldn't have prevented the data theft but at least one can have a reasonable degree of certainty that your individual account will not be compromised with a simple password. I also strongly suggest that you change the answer to the one-and-only secret question to something completely unrelated. For example…

> I don't understand why eBay (and others) don't offer two-factor authentication eBay implements 2-factor auth via a PayPal s/Key hardware token. https://www.paypal.com/securitykey

Doesn't that just protect PayPal? How does it protect from someone social-engineering their way into your eBay (not paypal) account through, say, customer service?

Re: Hackers raid eBay in historic breach, access 145 million records

#93

Post by CamperBob2 »

dchest wrote: post #86
mnw21cam wrote: post #74

Earlier quoted context omitted.

So we know how incompetent this rather large and famous company is, and how much we should trust them in the future. Being able to point and laugh is nice too, all seriousness notwithstanding.

I understand the curiosity, but I'm pretty sure the title of this post is enough to estimate how much you should trust them in the future. (Laughing... yes, but people demanding, by law/at the gun point, to know which password scheme companies use is as far from fun as we can get.)

(Shrug) It may be time to discuss legislation regarding secure storage of user information. It seems clear that many companies are not willing to use best practices without being forced.

Re: Hackers raid eBay in historic breach, access 145 million records

#94

Post by chrissyb »

jacquesm wrote: post #90
chrissyb wrote: post #84

Earlier quoted context omitted.

What is the new eBay? That's a serious question too, not rhetoric.

Excellent question, I had ebay in a post I was preparing, I've updated the text and bit and posted it. http://jacquesmattheij.com/ripe-for-disruption Ebay has been setting itself up for failure for a long time now, but I'm not surprised that people decided not to take on Goliath. But with this incident there might just be an opportunity to swing the scales in favour of a new entrant.

Hey good read - particularly agree with alot of the points you make. eBay's UI and design - whats going on there? Its OK by 2002 standard but i just feel like i'm browsing a Geocities shopping cart.

I'm looking forward to disruption here!

Re: Hackers raid eBay in historic breach, access 145 million records

#95

Post by hackinthebochs »

dchest wrote: post #71
sgk284 wrote: post #69

Earlier quoted context omitted.

If you use a secure password and the scheme the company uses is something like scrypt or bcrypt with high work factors, you can be near-certain that your password won't be cracked by an attacker. The amount of computation is just extraordinary. That said, you would still probably want to change your password if you're paranoid.

If you are capable of estimating the cost of cracking your password, you're capable of understanding that you should use different passwords on different websites and that you should change your password in event of compromise. In which case, the fact that attackers know your leaked password doesn't change anything. The same thing applies to knowing the particular password hash they used: if your password had enough…

>and that you should change your password in event of compromise.

This doesn't follow. If you estimate that the cost of cracking your password is infeasibly high, there is no reason to change your password.

Re: Hackers raid eBay in historic breach, access 145 million records

#96

Post by hackinthebochs »

dchest wrote: post #80
joshu wrote: post #77

Earlier quoted context omitted.

If they were someone who used the same password everywhere, then if the password was recoverable, they need to change the password everywhere. Not the brightest password strategy but a valid question.

They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing. (Remember that eBay asked users to change passwords?) But even so, the knowledge of password storage scheme in this case is actually harmful! Suppose Alice is reusing passwords, like you said. She learns that eBay used bcrypt, and due to this knowledge thinks her password is safe, and doesn't change h…

>They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing

I don't see why you keep saying this. These sorts of one-size-fits-all responses to security is why the state of security to day is so bad. A salted hash in itself is useless if you can't decrypt it. If their hashing technique was properly implemented then a good password will be impossible to decrypt. In this scenario there is no reason to change your password.

Personally, the value of an easy to remember password is higher than the miniscule risk of it being decrypted and used for nefarious purposes (which is limited by the fact that nothing of importance is linked to this particular password). I probably won't be changing my ebay password.

Re: Hackers raid eBay in historic breach, access 145 million records

#97

Post by dchest »

hackinthebochs wrote: post #96
dchest wrote: post #80

Earlier quoted context omitted.

They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing. (Remember that eBay asked users to change passwords?) But even so, the knowledge of password storage scheme in this case is actually harmful! Suppose Alice is reusing passwords, like you said. She learns that eBay used bcrypt, and due to this knowledge thinks her password is safe, and doesn't change h…

>They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing I don't see why you keep saying this. These sorts of one-size-fits-all responses to security is why the state of security to day is so bad. A salted hash in itself is useless if you can't decrypt it. If their hashing technique was properly implemented then a good password will be impossible to decrypt…

No, good password is infeasible to brute-force (not "decrypt", hashing doesn't encrypt anything; I invite you to research the topic you're talking about) even if you use non-salted SHA-1. Slow password hashing is there to protect weak passwords.

In the event compromise like this, you need to change password regardless, because you can't be certain if, for example, attackers had access to server memory (remember that password is kept there before hashing?) or not.

These sorts of one-size-fits-all responses to security is why the state of security to day is so bad.

This sentence is completely false.

Re: Hackers raid eBay in historic breach, access 145 million records

#98

Post by dchest »

hackinthebochs wrote: post #95
dchest wrote: post #71

Earlier quoted context omitted.

If you are capable of estimating the cost of cracking your password, you're capable of understanding that you should use different passwords on different websites and that you should change your password in event of compromise. In which case, the fact that attackers know your leaked password doesn't change anything. The same thing applies to knowing the particular password hash they used: if your password had enough…

>and that you should change your password in event of compromise. This doesn't follow. If you estimate that the cost of cracking your password is infeasibly high, there is no reason to change your password.

Which is a confirmation that you cannot properly estimate risk/effort involved; the knowledge of the scheme they used to store passwords is useless for you, or even harmful.

Re: Hackers raid eBay in historic breach, access 145 million records

#99

Post by hackinthebochs »

dchest wrote: post #97
hackinthebochs wrote: post #96

Earlier quoted context omitted.

>They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing I don't see why you keep saying this. These sorts of one-size-fits-all responses to security is why the state of security to day is so bad. A salted hash in itself is useless if you can't decrypt it. If their hashing technique was properly implemented then a good password will be impossible to decrypt…

No, good password is infeasible to brute-force (not "decrypt", hashing doesn't encrypt anything; I invite you to research the topic you're talking about) even if you use non-salted SHA-1. Slow password hashing is there to protect weak passwords. In the event compromise like this, you need to change password regardless, because you can't be certain if, for example, attackers had access to server memory (remember that…

>not "decrypt", hashing doesn't encrypt anything; I invite you to research the topic you're talking about

You are familiar with a colloquialism, are you not? Imprecise language like this is common among experts in just about every field. You don't not get points for being a pedant when everyone understands what is meant by decrypt in this context.

> because you can't be certain if, for example, attackers had access to server memory

Which is why I asked about the details of the compromise. Getting full access to memory of a system is a few orders of magnitude more difficult than getting admin credentials to a DB.

>This sentence is completely false.

Nope. A decade ago the common security advice was "just MD5 it", and we're still suffering through this boneheaded advice today. Teach concepts, not catchphrases.

Re: Hackers raid eBay in historic breach, access 145 million records

#100

Post by dchest »

hackinthebochs wrote: post #99
dchest wrote: post #97

Earlier quoted context omitted.

No, good password is infeasible to brute-force (not "decrypt", hashing doesn't encrypt anything; I invite you to research the topic you're talking about) even if you use non-salted SHA-1. Slow password hashing is there to protect weak passwords. In the event compromise like this, you need to change password regardless, because you can't be certain if, for example, attackers had access to server memory (remember that…

>not "decrypt", hashing doesn't encrypt anything; I invite you to research the topic you're talking about You are familiar with a colloquialism, are you not? Imprecise language like this is common among experts in just about every field. You don't not get points for being a pedant when everyone understands what is meant by decrypt in this context. > because you can't be certain if, for example, attackers had access t…

Imprecise language can be used, but not when two terms mean completely different things.

"Just MD5 it" advice was not given by knowledgeable security experts. The practice of using a slow cryptographic function to derive password hashes goes back at least to the 1978 paper "Password Security: A Case History" by Robert Morris and Ken Thompson. (I have collected some implementations of historic password hashes (many of which are weak) here: https://github.com/dchest/historic-password-hashes)

Post reply on HN