3 ms·

See https://news.ycombinator.com/item?id=10697045 https://news.ycombinator.com/item?id=10697045 Piwik is still using (unsalted) MD5 for passwords in 2015, and

See https://news.ycombinator.com/item?id=10697045 https://news.ycombinator.com/item?id=10697045 Piwik is still using (unsalted) MD5 for passwords in 2015, and probably will still be using unsalted MD5 in 2016.

etjossem 11y ago
This is pretty bad. Piwik could be a high value target depending on the nature of the site it is used to analyze. I can't believe unsalted MD5 is "by design" (https://github.com/piwik/piwik/issues/8753 https://github.com/piwik/piwik/issues/8753).
- sarciszewski 11y ago
  https://theintercept.com/2014/02/18/snowden-docs-reveal-covert-surveillance-and-pressure-tactics-aimed-at-wikileaks-and-its-supporters/ https://theintercept.com/2014/02/18/snowden-docs-reveal-cove... Considering Piwik is used by the GCHQ, I find it hilarious.
  - Someone1234 11y ago
    They're using an open source analytics software package to analyse the very data it was designed to analyse. I don't find it using poorly implemented hashing in the administrative interface to be at all relevant to what they're doing, or why they shouldn't be using it.
    - etjossem 11y ago
      Information on who visits WikiLeaks - and what they read and upload - is an incredibly high value target. I don't see how you can argue otherwise, when Britain's top intel agency has an expensive line item in their budget just to get at that info. Given these known security flaws, it's not a stretch to assume anyone who can see the GCHQ's Piwik server can have that data too, regardless of whether they are authorized. See below for a small preview of what an attacker could exfiltrate (dissident IPs redacted for a reason): https://firstlook.org/wp-uploads/sites/1/2014/02/piwik2.png https://firstlook.org/wp-uploads/sites/1/2014/02/piwik2.png While we're talking about poor security practices: the privileged username in the screenshot is apparently still the default ("admin"), so I hope the password isn't still "changeMe" ... http://piwik.org/faq/how-to/faq_191/ http://piwik.org/faq/how-to/faq_191/

etjossem 11y ago

This is pretty bad. Piwik could be a high value target depending on the nature of the site it is used to analyze. I can't believe unsalted MD5 is "by design" (https://github.com/piwik/piwik/issues/8753 https://github.com/piwik/piwik/issues/8753).

sarciszewski 11y ago
https://theintercept.com/2014/02/18/snowden-docs-reveal-covert-surveillance-and-pressure-tactics-aimed-at-wikileaks-and-its-supporters/ https://theintercept.com/2014/02/18/snowden-docs-reveal-cove... Considering Piwik is used by the GCHQ, I find it hilarious.
- Someone1234 11y ago
  They're using an open source analytics software package to analyse the very data it was designed to analyse. I don't find it using poorly implemented hashing in the administrative interface to be at all relevant to what they're doing, or why they shouldn't be using it.
  - etjossem 11y ago
    Information on who visits WikiLeaks - and what they read and upload - is an incredibly high value target. I don't see how you can argue otherwise, when Britain's top intel agency has an expensive line item in their budget just to get at that info. Given these known security flaws, it's not a stretch to assume anyone who can see the GCHQ's Piwik server can have that data too, regardless of whether they are authorized. See below for a small preview of what an attacker could exfiltrate (dissident IPs redacted for a reason): https://firstlook.org/wp-uploads/sites/1/2014/02/piwik2.png https://firstlook.org/wp-uploads/sites/1/2014/02/piwik2.png While we're talking about poor security practices: the privileged username in the screenshot is apparently still the default ("admin"), so I hope the password isn't still "changeMe" ... http://piwik.org/faq/how-to/faq_191/ http://piwik.org/faq/how-to/faq_191/