Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
forum.opensubtitles.org
Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
1–10 of 194 posts
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#2> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt
Ouch!
I hope they learned their lesson: Security is an ongoing effort.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#3Which is why I use password manager, with one unique & strong password per site.
Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago)
When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#4> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Ouch! I hope they learned their lesson: Security is an ongoing effort.
for 2006 that's actually not bad.
When I joined my first company in 2010, to my horror, they were using plain text passwords for users
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#5What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that would be amazing. Thanks HN
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#6What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…
> I can not believe the motivation can simply be to get subtitles to watch movies personally
Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#7> Tue Jan 18, 2022 2:34 pm
> In August 2021 we received message on Telegram from a hacker, who showed us proof that he could gain access to the user table of opensubtitles.org, and downloaded a SQL dump from it.
Wait, they got proof in August and release the info only now? Was this because they were trying to be in a talk with the hacker? It wasn't really clear, but it's a long time...
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#8> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted
Wait, what? Definitely lesson not learned:
- sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed passwords are rainbow tables). At least with salt+pepper it limits attack surface, but instead you should be hashing your passwords with:
- `password_hash`[1] should be used instead of `hash_hmac`, with the algorithm being "PASSWORD_BCRYPT" or better[2]. This is a slow hashing method, meaning anyone trying to rainbow-table attack your passwords will have a hard time.
- A common technique is not to delete old passwords, but instead to rehash them with the new algorithm. This would be useful for moving from sha256 => bcrypt, since collisions on sha256 are not practical, but if the original hash was md5 then I think it's fine to delete the md5 passwords and require a new one. Good luck to those who changed their email in 15 years though.
[1] https://www.php.net/manual/en/function.password-hash.php
[2] I haven't followed the space too closely for 3-4 years, I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#9At one point I think you could use opensubtitles.org without a username and password. I wonder in hindsight if the liability of storing PII was worth it?
Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames
#10What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…
> I can not believe the motivation can simply be to get subtitles to watch movies personally Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?
Well, not when licensed entertainment is involved. Subtitles may sound harmless but are enough to start a court battle. This happened in Poland with a similar site. I would not dare to claim that authors motives and all actions were clean and done in the open, but for sure they were targeted by various media groups for copyright infringement just because of plain subtitles.
You need resources to deal with that and it's not gonna be a clean fight.