20 ms·
100M clear text passwords stolen from Russia's biggest social network
- Artlav 10y agoOfficial local news: This never happened. Slightly less advertised news: This never happened, the data is from a 2011-2012 leak, and everyone from it was forced to change passwords long ago. The "33,236 times" password is actually mildly obscene, meaning something close to "everything went to hell". Doesn't make any special sense to me.
- marak830 10y agoThanks I was wondering what it meant. Lol. Guess it's a bit of a prophetic password
- Sacho 10y agoDoes the number 0211 after it hold any significance?
- Artlav 10y agoCan't think of any. Could be November 2nd, could be February 2011, could be whatever. It's not a reference to anything i'm aware of.
- hamstergene 10y agoMy guess: someone was registering thousands of bots using common swearing words + some number as their password, and this particular spam campaign happened to be particularly large.
- executesorder66 10y agoBetter link: https://www.leakedsource.com/blog/vk https://www.leakedsource.com/blog/vk
- tomtoise 10y agoSeen that site being spammed all over Reddit. At best, grey, at worst, scummy. Edit: LeakedSource has been wrong in the past and will be wrong again. https://news.ycombinator.com/item?id=11805691 https://news.ycombinator.com/item?id=11805691 They're leeches of the worst kind.
- executesorder66 10y agoI didn't know that. Thanks. I just happened to find more information on the leak on the page that I linked.
- davotoula 10y agoWhat makes "PolniyPizdec0211" such a popular password?
- lossolo 10y agoClear text passwords? I thought it's 2016. If you are not using bcrypt/scrypt or similar in 2016 then you should change profession.
- varjag 10y agoThe founder now runs secure messaging service with roll-your-own crypto.
- strictnein 10y agoYep. Pavel Durov was forced out by various Kremlin connected folk for daring to stand up to the FSB and the Kremlin. He also went public about their unlawful requests. He then fled Russia. edit: ugly sentence structure.
- aleksi 10y agoYes, it's 2016, but they say that passwords were collected in 2011-2012/2013. Also, phrasing in Russian sources suggests that passwords were not dumped from DB, but actively collected by other means.
- cm2187 10y agoTo get close to 50% of the user base? Sounds like a very very high success rate.
- paulmd 10y agoOr PBKDF2, which would be my preference in any stuffy corporate environment. Nobody ever got fired for following NIST/FIPS standards. I'd use bcrypt if I were working on my own project though. I think scrypt goes too far, I would actually be concerned about its speed and memory utilization hurting responsiveness for any sort of web server or other latency-sensitive system.
- drakenot 10y agoJust yesterday I clicked on the "Forgot Password" link on the AutoTrader.com website. I was expecting a reset link in my email and instead they just emailed me my password in cleartext. This is a huge website! Not some small business. It completely baffles me. I wish that there was some way to shame these companies. I've seen some websites that list some of these offenders but they don't appear to be effective enough. I want news articles written about these companies in the magazines that the CIOs care about, with their photo right next to the article.
- acqq 10y ago> Almost as surprising is the 24,309 times that ‘marina’ is found as a password here It's a common name, apparently the English speakers traditionally translated Greek name Μαρίνα (Marina) to "Margaret."
- raverbashing 10y agoInstead of idiot questions like FizzBuzz maybe recruiters should be asking about password storage best practices instead
- rcconf 10y agoI've asked these questions in interviews and a lot of programmers seem to know the basics (what a hash is), but seem to fall short when it comes to things like what a salt is, modern storage techniques (bcrypt, scrypt, PBKDF2) and how rainbow attacks can be used to crack hashes. It's a bit tricky to fail someone in an interview because they don't know security. I think the better way to handle security in a company is to hire a programmer that knows it and teaches it to other programmers during code reviews.
- t3nary 10y agoHashing with an insecure algorithm and without good salting isn't much better that not hashing at all though.
- dzhiurgis 10y agoHow do you store salt?
- CiPHPerCoder 10y agoThat question should never even need to be asked. The library you're using should take care of that for you. In PHP: $storeMe = password_hash($plaintext, PASSWORD_DEFAULT); if (password_verify($plaintext, $storeMe)) { // Logged in } The detail is totally abstracted away. All sane password hashing libraries offer this API. See: https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016 https://paragonie.com/blog/2016/02/how-safely-store-password... EDIT - CANNOT REPLY: > One major failure of this article: > > You should generate a random salt for each user and store it alongside the user > record in the DB. No, you shouldn't. Your library should do that for you, and store it as a single string that's opaque to the developer. > I completely disagree. This implies that my DB ORM handles password stuff, > which doesn't make sense. See the passlib section: https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016#python https://paragonie.com/blog/2016/02/how-safely-store-password...
- welder 10y agoLooks like it's being sold for 1 BTC [1]. Screen Shot: https://www.instagram.com/p/BGUE5H2yqa_/ https://www.instagram.com/p/BGUE5H2yqa_/ [1] http://trdealmgn4uvm42g.onion/listing/3716 http://trdealmgn4uvm42g.onion/listing/3716
- tomtoise 10y agojudging from that 'gram shot, it looks like VK didn't bother actually deleting user profiles (a lá Ashley Madison). Will be interesting to see the fallout from this, if confirmed.
- hackim 10y ago'dadada' password...
- acak 10y agoI'm sorry, I hate pointing anything negative out. Was it a recent change to store passwords in clear text? It's worrying because the founders of VK started Telegram which claims to be end-to-end encrypted.
- dchest 10y agoNo, in 2007 they even sent your password to email immediately after creating account: https://twitter.com/dchest/status/739804779296219136 https://twitter.com/dchest/status/739804779296219136 There was also "remind password" feature: https://twitter.com/extractor/status/739801634423857152 https://twitter.com/extractor/status/739801634423857152 Also, they used to store MD5(password) in cookies. Yes, these are the same people who made Telegram.
- greenleafjacob 10y agoSending your password in plain text in email doesn't mean it's stored in plain text; it could be copied from memory into the email before being discarded at the end of execution of the initial request.
- dchest 10y agoIf you ever find a service that is stupid enough to send password by email, but smart enough to store it hashed, please let me know. Also, you missed a part of my comment where I said that they sent passwords by email when you clicked "I forgot password".
- CiPHPerCoder 10y agoIsn't this by the same folks who brought us Telegram?
- sakopov 10y agoI just logged into VK to change my password. It happily accepted a 30-character generated password (alpha-numeric with upper/lowercase and special characters). However, i was not able to login with it after changing the password. Tried using their password recovery tool that texts you an MFA code. It never came. Attempting to send another one gave me "You exceeded daily attempts limit" error message. I guess tomorrow i'm going to TRY to login to just delete the damn account all together.
- deleted 10y ago[deleted]
- asadlionpk 10y agoIt's crazy how passwords are stored in these sites with millions of users. Secure password storage is one of the top priorities of mine when I am training internees or teaching someone web app dev.
- Mahn 10y agoThere's an old saying, "the world runs on shitty code". I always think of that when I see headlines like these.
- nekopa 10y agoOT question: VK is the "Russian Facebook". The article claims it has 280 million users, but a quick Google shows Russia has a population of 143 million. What gives? Russian speaking countries? Multiple accounts per user?
- hayksaakian 10y agoit's not exclusively used by people in Russia, people in russian speaking countries, ukraine and other eastern european countries use it too.
- 3pt14159 10y agoVK is actually available in essentially all modern languages and is very popular in Belarus, Ukraine, and Kazakhstan; and sometimes used in countries with large numbers of immigrants from those four countries (Canada, Israel, etc) to check on family members or friends.
- ronreiter 10y agoCan anyone send a download link? I'm dying to analyze the passwords
- frandroid 10y agoWhat if the Kremlin asked them to not encrypt passwords, so they could be harvested?