Update on Tuts+ Premium Security Breach
notes.envato.com
Update on Tuts+ Premium Security Breach
1–10 of 25 posts
Re: Update on Tuts+ Premium Security Breach
#2I anticipate the service will be coming back online in the next 24 hours, with all passwords reset, hashed and individually salted (a best practice)
Sigh.
Re: Update on Tuts+ Premium Security Breach
#3[deleted]
Re: Update on Tuts+ Premium Security Breach
#4NetTuts needs to mention which key derivation function they are using so the community can verify they didn't fuck up again.
I would also recommend that they use this opporunity to teach their web developing users about proper password storage, but after reading their php hashing tutorial[1], I think it's best if their users look elsewhere. The tutorial eventually recommends bcrypt after listing multiple unsafe solutions. I understand that the author is trying to build up to the solution, but the correct solution needs to be in the first paragraph. The incorrect solutions need to be clearly flagged so a beginner skimming through doesn't see "md5" and stop.
[1] http://net.tutsplus.com/tutorials/php/understanding-hash-fun...
Re: Update on Tuts+ Premium Security Breach
#5At least give it to them for being straight forward and honest. Yes, they screwed up, but so have a lot of other companies that in my opinion hold much much more sensitive data about me.
Not saying it's right for them to not take security as serious as they should have, but unlike a lot of other companies, they disclosed it immediately, came up with a game plan, apologized multiple times and are refunding users and offering others free stuff.
I've changed my password on the other envato services I use as a just in case and I still plan on using them in the future. They've always put together great and in-depth tutorials and are a great resource for beginners, hackers and experts.
Re: Update on Tuts+ Premium Security Breach
#6I anticipate the service will be coming back online in the next 24 hours, with all passwords reset, hashed and individually salted (a best practice) Sigh.
In of itself, the statement isn't incorrect though is it? Are you sighing because you believe the statement implies a poor hash function will be chosen?
Re: Update on Tuts+ Premium Security Breach
#7NetTuts needs to mention which key derivation function they are using so the community can verify they didn't fuck up again. I would also recommend that they use this opporunity to teach their web developing users about proper password storage, but after reading their php hashing tutorial[1], I think it's best if their users look elsewhere. The tutorial eventually recommends bcrypt after listing multiple unsafe solut…
There's no real way to 'verify' this. They would have to provide the source code in its entirety and several card-carrying, certified cryptanalysts/cryptographers would have to vet it and then publicly approve of it. That will never happen.
Users have to have some level of trust. Like everything else in life.
Re: Update on Tuts+ Premium Security Breach
#8I anticipate the service will be coming back online in the next 24 hours, with all passwords reset, hashed and individually salted (a best practice) Sigh.
In of itself, the statement isn't incorrect though is it? Are you sighing because you believe the statement implies a poor hash function will be chosen?
They were running a database with clear text passwords, in my opinion, their vague statements should get a pessimistic reading.
Re: Update on Tuts+ Premium Security Breach
#9I anticipate the service will be coming back online in the next 24 hours, with all passwords reset, hashed and individually salted (a best practice) Sigh.
In of itself, the statement isn't incorrect though is it? Are you sighing because you believe the statement implies a poor hash function will be chosen?
It's not incorrect, but it's somewhat telling that such a massive vulnerability that they were fully aware of "has been running for a long time" and rather than fork over $179.95 for the new version of aMember which would have completely fixed the vulnerability, they chose instead to let the vulnerability remain while they embarked on a greenfield project to rewrite their membership system from scratch. This rewrite would take an indeterminate amount of time whereas they could have paid a paltry sum for the upgrade and implemented it in less than 48 hours... as they just did.
I get that it's a prioritization issue. I've worked at places where legacy software had poor security practices and it's often a judgment call as to the risk of just letting it be vs. taking the time to rewrite whatever insecure portion remained. Often the decision is to leave it when it's a one-off project that will be shut down within a month, there is a limited attack surface involved, and the data being stored insecurely is very low value. On the other hand, security issues affecting the very core of a website (the login system that 100% of a company's revenue depends on) should get addressed as soon as the vulnerability is discovered. Additionally, they state that a server was compromised... it's not clear whether this was a SQL injection exploit that happened to display the users table remotely with no privilege escalation, or whether the server was compromised via a poorly chosen SSH password or similar and they may be dealing with a situation where rogue code is still living on one or more servers.
Re: Update on Tuts+ Premium Security Breach
#10NetTuts needs to mention which key derivation function they are using so the community can verify they didn't fuck up again. I would also recommend that they use this opporunity to teach their web developing users about proper password storage, but after reading their php hashing tutorial[1], I think it's best if their users look elsewhere. The tutorial eventually recommends bcrypt after listing multiple unsafe solut…
There's no real way to 'verify' this. They would have to provide the source code in its entirety and several card-carrying, certified cryptanalysts/cryptographers would have to vet it and then publicly approve of it. That will never happen. Users have to have some level of trust. Like everything else in life.
Absolute verification is impossible, but this doesn't mean more verification isn't helpful. NetTuts should publicly says what key derivation function they are using. Could they be lying? Maybe. Could they have other security vulnerabilities? Probably. Would I trust NetTuts with my credit card number? No.