9 ms·
65M Tumblr Passwords for Sale on TheRealDeal
- Navarr 10y agoHashed and Salted sha1 should take basically no time to crack at all.
- tedks 10y agoIt's my lay understanding this is true; there's a reason we all switched to bcrypt, right? But this comment is getting downvoted. What's the deal?
- alanh 10y agoIt is lacking in nuance, information, and clarity. (Surely a significantly strong password wouldn't be immediately cracked when hashed & salted, right? I don’t know for sure, and that comment isn't helping.)
- wavelattice 10y agoIf you read the article, it says the passwords are hashed and salted. So I think the comment is appropriate... I don't think this is the same thing as passwords being sold at all.
- tonmoy 10y agoThis was sarcasm right? In all seriousness though, I think titles like "passwords stolen" are a little misleading. Article titles should either be "hashed passwords stolen" or "plaintext passwords stolen" IMO.
- rudolf0 10y agoNo, he's absolutely right. Single-iteration SHA-1 is extremely inappropriate for password hashing, and all salting does is prevent rainbow table attacks and instant reversal of duplicate hashes. It does not slow down non-precomputed attacks one bit. It's much better than plaintext, but essentially only a little bit better than unsalted MD5. I'm really surprised Tumblr would use such an awful password storage scheme as late as 2013. I thought they invested a lot into security?
- vonmoltke 10y agoFrom the perspective of trying to crack a single user's account the salt does not slow down non-precomputed attacks at all. From the perspective of trying to crack the entire database, or a significant portion of it, it multiples the work required by N (where N is the desired number of cracks to perform).
- rudolf0 10y agoI mean, it depends how you look at it. I consider precomputed attacks a special case of these attacks, sort of. In the security world, most password-predicting attacks are linear with respect to the amount of accounts you're trying to get passwords for. It's true that it will take a lot of hardware to efficiently attack all 65 million passwords. But in my field, big dumps like these are a godsend when doing a pentest. Looking to compromise a sysadmin's account? Search his/her emails and aliases in as many DB dumps as you can find, then expend a lot of resources cracking that one hash. If it's just a SHA-1 hash and the password isn't very strong, you won't have much trouble. Also a risk for people with vendettas against specific tumblr users (which, to my understanding, is a big issue on tumblr).
- xyience 10y agoBrute force as an attack vector is dealt with by requiring "strong" passwords, not by using scrypt, so the thought of using a hash that protects all passwords equally with respect to the time it takes to try one, as an extra layer of defense for those weakest of the "strong" passwords, doesn't usually come up unless you're actually looking into how to design a login system instead of just copying from somewhere/some book as fast as you can and moving on. This issue with Tumblr that late doesn't surprise me at all. At least one major benefit of SHA over MD5 is that you won't trivially find collisions and thus compromise the accounts of even those users with strong passwords...
- deleted 10y ago[deleted]
- PaulyGlott 10y agoIn this case, it should be "Salted Password Hashes Stolen"
- pg_is_a_butt 10y agosalted with what? unique salts per password? hashed with what? in many cases you're 5 minutes away from plaintext passwords, so the distinction is meaningless.
- avar 10y agoIt still depends on the password. I've changed my Tumblr password after this just in case, but it was some approximately hundred character random password generated by Lastpass before that. So let's say half the ASCII range, which gives us this number of possible passwords: (2^7/2)^100 41495155688809929585124078636911611510124462322424368999956573296906\ 52811412908146399707048947103794288197886611300789182395151075411775\ 307886874834113963687061181803401509523685376.00000000000000000000 I'm pretty sure even if it's just stored as single-iteration sha1() cracking it would take until the heat death of the universe.
- Navarr 10y agoThat's a fair point, but I do not believe password managers are currently the norm for a userbase like tumblrs. Still, the hash time for a SHA1 is fairly insignificant at this point.
- pg_is_a_butt 10y agothe heat death of the universe, or until an attacker realized Lastpass has been breached multiple times, and they already have every password you've ever used with it. you're an: i\ d\ i\ o\ t.00000000000000000000
- giancarlostoro 10y agoAs shared in the link, if you want to check if your Tumblr account was compromised check out: https://haveibeenpwned.com/ https://haveibeenpwned.com/
- Kequc 10y agoIt's amazing. Just about every single one of my email addresses have been compromised in one way or another, how could it be there are so many websites with such bad security.
- pg_is_a_butt 10y agoor, you're just attracted to bad websites. the problem is likely with you.
- cloudjacker 10y agoThat site is amazing, I can look up anyone's email address and see what hacked communities they are a part of
- deleted 10y ago[deleted]
- rahkiin 10y agoWell, the data is already on the internet...
- cloudjacker 10y agoit is more convenient, just upvote and move on
- gambler 10y agoUnless they use different emails for different websites. This sounds extreme, but you just pointed out one reason that might be a good idea.
- alanh 10y ago- From the 2013 data breach - HaveIBeenPwnd contains the data on sale here
- giancarlostoro 10y agoIf you don't know what HaveIBeenPwnd is, you type in your email to check if it is involved in any data breaches online. They don't give you the actual data back.
- drhayes9 10y agoNow is a great time to add two-factor authentication to your account after you change your password.
- 1024core 10y agoProblem with 2FA is: what happens when you're traveling internationally and don't have access to your phone number, and need to look up your bank balance or something where you've employed 2FA?
- oddevan 10y agoOne solution is to use Google Authenticator (or a similar compatible app) that generates the codes on-device so no data/SMS connection is needed.
- gambler 10y agoYou still need your phone for that. If you're out of battery charge, you're temporarily locked out. If you loose your phone, you're locked out until you recover the number. If you can't recover the number for some reason, then what? People downplay the probability and importance of these issues, but the situations where you loose your phone are often the situations where you need access to your online accounts. One such situation can do far more damage than all the hacks combined. (For example, someone steals your backpack with your phone and wallet. Horror scenario: someone steals your backpack with your phone and wallet in a foreign country.) In short, loss of access must be considered as a tradeoff. Loosing anonymity due to phone-based 2FA is another issue that never seems to be considered in these discussions. Finally, phone-based 2FA discourages you from splitting your accounts. (It's a bit of a hassle even with one email. Imagine managing 5 or 6.)
- gilrain 10y agoThat's when you use the one-time passwords you generated and printed out in case of just such an emergency. Most (important) services I've enabled 2FA on make this an explicit step.
- martin-adams 10y agoJust looking at the haveibeenpwned.com it links to the cryptically poor Adobe password were. I am fascinated by how popular certain passwords are: http://stricture-group.com/files/adobe-top100.txt http://stricture-group.com/files/adobe-top100.txt It appears some random words aren't necessarily random. Words like 'shadow' and '1q2w3e4r'. Fascinating!
- ben_jones 10y agoYou can probably get even more correlation if you account for "l33tspeak" i.e. swapping letters for numbers that look like them. password => p455w0rd password => passw0rd
- MichaelGG 10y agoDon't forget adding ! or 101 and so on to the end of a password and capitalizing the first letter. "Password1!" is likely to pass complexity and length requirements quite well.
- fuzzywalrus 10y agoThe top ten passwords in the in the adobe hack account for 2.8% of all passwords. About 1/35 used one of ten passwords. That's frightening to think about. Thanks for the share.
- therealmarv 10y agoIt's a shame Tumblr and Yahoo... we are informed 3 (!!!) years after this breach. Unbelievable.
- whatgoodisaroad 10y agoThank goodness 2013 was before I had to change my Tumblr password (and activate 2fa) because of Heartbleed.
- drivingmenuts 10y agoAlso a shame that the people that pulled this off are allowed to live.
- ChrisClark 10y agoTranslation: > Oh no! Someone has my email address and unique hashed password, they should be shot!
- Bromskloss 10y agoThanks for translating. I wasn't sure what method of execution was implied.
- dang 10y agoPlease don't do this here. We're looking for thoughtful discussion, not extreme one-liners or snark. We detached this subthread from https://news.ycombinator.com/item?id=11809297 https://news.ycombinator.com/item?id=11809297 and marked it off-topic.
- drivingmenuts 10y agoFor the record: not a Tumblr user. My opinion is that people who commit those acts need to be killed as an example to others. Some will argue that they perform a public service of some sort, but the fact is, they're bullies, plain and simple. They are past any public service point and now are off into lulzland, where they're selling this information because they will profit from it. I cannot envision that there is any sense of remorse in these people, either. I am fairly certain they will get away with this - odds are against them ever being caught in a country with a decent enough justice system to apply a lasting verdict. Even finding enough proof to convict is a very long shot. The part of me that despises bullies, though, wants to line them up in front of their colleagues and say "Do what you want, but remember, there are consequences. This is consequences." and turn them into a thin, red smear. I try to avoid posting while angry these days, because it's really pretty useless. Sometimes, though, can't help it.
- deleted 10y ago[deleted]
- an_ko 10y agoThe primary source (of Tumblr confirming the leak) wasn't linked from the article (Tumblr Staff Blog, May 12th 2016): https://staff.tumblr.com/post/144263069415 https://staff.tumblr.com/post/144263069415
- ohitsdom 10y agoLink to change your Tumblr password: https://www.tumblr.com/forgot_password https://www.tumblr.com/forgot_password
- Bromskloss 10y agoBut… I don't have a Tumblr account!
- Spooks 10y agoalso, if for some bad reason your Tumblr password is the same as your email, make sure you change that as well. (as they have emails of the accounts)
- thesimpsons1022 10y agoI wish i could find my hash because I used tumblr back then but have deleted my account since then. I just want to know if it is a password i'm still using or not.
- rvense 10y agoBeen in this situation a few times now. It's dawning on me that this is why they say not to use the same password in more places..
- thesimpsons1022 10y agowell I have a lot of accounts I don't care much about, but it's still nice to know. the ones I do care about: Amazon, banking, Facebook etc do you have unique passwords.
- nolepointer 10y agoWow, whoever is responsible for this is a real shitlord!
- thesimpsons1022 10y agojust curious. from 1 to Snowden how illegal is it to buy or access this dataset?
- RamenJunkie_ 10y agoThese Tumblr Passwords are probably useless. Last time I logged into both my Tumblr accounts there was a required Password reset.