12 ms·
GitHub Security Update: Reused Password Attack
- natch 10y agoWhat the page doesn't tell me is: What is their definition of an "affected" account? Obviously one where an attempt was made, and succeeded, would count as affected. But would an account where an attempt was made, and failed, also count? What if the userid and password are correct, but 2FA stopped the attack on an account. Is that account affected, in their view?
- paulannesley 10y ago> But would an account where an attempt was made, and failed, also count? I wouldn't think so. There must be countless incorrect password attempts all the time. > What if the userid and password are correct, but 2FA stopped the attack on an account. Is that account affected, in their view? Interesting question. I'd hope they'd inform me if somebody had my password and was only blocked by 2FA.
- DanCardin 10y agoWouldnt you have gotten unexpected 2fa notifications if that were the case?
- nathankleyn 10y agoThis is true only if you use SMS for 2FA. For either method, you can audit the activity of your account on the GitHub security page: https://github.com/settings/security https://github.com/settings/security. For example, upon having deliberately got my 2FA token wrong, "user.two_factor_requested" and "user.failed_login" events were logged for me.
- eric_h 10y agoInteresting, I'd never checked that log before, and I just noticed a failed login (though no two_factor_requested) from an IP address in Brazil. I'm gonna change my password just in case.
- qnk 10y agoMy guess is that all affected accounts are those that had multiple successful and/or unsuccessful login attempts coming from the same source.
- jrockway 10y agoI hadn't noticed that Github started supporting U2F. Nice to finally use my keys for something other than Google accounts.
- vulpino 10y agoDropbox does too! Unfortunately, those are the only sites supporting U2F I know of at the moment.
- jonafato 10y agohttp://www.dongleauth.info/ http://www.dongleauth.info/ maintains a list of sites supporting U2F devices. There aren't many yet, but it looks like a Wordpress plugin exists that may end up in core. There are also a handful of additional sites listed in issues and pull requests on the site's GitHub page (https://github.com/Nitrokey/dongleauth https://github.com/Nitrokey/dongleauth). (I'm not affiliated with the site, I just check it periodically and thought it might be of use here.)
- bojo 10y agoBitbucket as well.
- deleted 10y ago[deleted]
- colemickens 10y agoThat's new! Took more tries than normal to register, but that's great. They took so long to roll out even TOTP based auth, I figured it would be ages before seeing U2F.
- deleted 10y ago[deleted]
- k33l0r 10y agoGoogle also supports U2F
- 10y ago
- akerl_ 10y ago"We immediately began investigating, and found that the attacker had been able to log in to a number of GitHub accounts."
- jlarocco 10y agoDid you even read what the OP asked? As he said, those counts are obviously affected, but the article (and your quote) give no indication of if accounts in the other categories (attempted but failed, attempted but stopped by TFA) are also notified that attempts were made.
- dang 10y agoThe site guidelines (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html) ask you not to post did-you-even-read comments to HN: Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." In this case a comment rather than an article, but the rule still applies. Consider how much more polite your comment would be with just the second paragraph.
- dang 10y agoWe detached this subthread from https://news.ycombinator.com/item?id=11913690 https://news.ycombinator.com/item?id=11913690 and marked it off-topic.
- tuna-piano 10y agoAnecdote: I use an email account and a relatively simple password (3 relatively common words together) on LinkedIn. I don't use that email account much, but it was affected by the Linkedin hack. Today I get an email saying my Twitter account was accessed suspiciously (same credentials). Power of the network effect that I won't leave Linkedin, and wouldn't think twice before spending money on the platform if I needed to recruit someone or do b2b sales. But screw Linkedin for not taking proper precautions.
- niij 10y agoYou're using a dictionary password and subsequently reusing that password on multiple sites.... and you're mad at LinkedIn for allowing your account to be compromised? Umm.
- Taek 10y agoYou are blaming the victim. Yes, they could have taken more steps to protect themselves, but those steps are inconvenient and cost everybody headspace and headaches. And if we're all being honest we don't use best practice every time we log into a website. The real problem is the way that we do passwords. Passwords should either be managed by your browser or your operating system. When you log in to your computer, you log in one time with a public key. And then your OS/Browser automatically logs you into every website you visit by signing challenges instead of by giving your private key (that's essentially what a password boils down to) to everyone who wants to verify your identity. The same is true for credit cards. If we want a more secure web, we will replace the password system. It's difficult to use passwords correctly, even if you have the common sense (which a lot of people don't, because they just don't realize it's a bad idea). It should be a higher priority. People are clearly losing money and losing quality of life over today's insecure password infrastructure.
- ejcx 10y agoOP isn't blaming the victim. Op is playing with fire, KNOWS IT, and is surprised when they get burned. Right now there are many solutions for password management. Free and open source, free and closed source, paid and closed source, enterprise. You name it! "Good password hygiene" is fairly ubiquitous amongst people on this site. With that said, credential management[0] is coming. Google and Apple want to kill LastPass, 1password, and all these companies, and they definitely will AFAICT. [0] https://www.w3.org/TR/credential-management-1/ https://www.w3.org/TR/credential-management-1/
- ledude 10y agojust a random tidbit.. but the system currently allows you to set your password to what you previously had
- emilong 10y agoI actually hope this is true as a consequence of them storing salted hashes for passwords. That is, Github should not ever see my password, only validate that I know what I entered previously.
- e28eta 10y agoIt's pretty easy to keep a list of old salted hashes, and copmare the new password's salted hash against the previous ones. It doesn't require saving the old passwords.
- ikeboy 10y agoIf the salt changes, you'd need to compute the password using multiple salts, which might have crypto guarantee issues when sent to the server.
- niftich 10y agoI don't follow what you're saying. To compare your new password with your old password, you take the old salt, hash your new password together with it, and compare the result to the old hash. If they match, you're trying to reuse the same password. You do this on the server side, naturally.
- ikeboy 10y agoIf everything is done server side, sure.
- niftich 10y agoWhy wouldn't it be? If salted hashing were done on the client side, it means you're actually sending username + saltedhash, instead of username + password to the server to log in. So an attacker could submit a precomputed or stolen salted hash to be compared against the stored one -- completely defeating the point of hashing passwords in the first place.
- kiwidrew 10y agoI received this e-mail and had my password reset by Github. Based on the "security history" shown in my Github account's setting page, my account wasn't compromised as there was no login activity during the past week. I'm thinking that this is fallout from the LinkedIn breach, because this is the first high-profile breach which includes one of my e-mail addresses. (How do I know this? I'm using haveibeenpwned.com -- a free service that I highly suggest registering with.)
- jqueryin 10y agoJust a thought, but GitHub could be handling this proactively to ensure the security of their members given the sensitivity of private repositories: Step 1: Grab LinkedIn breach data Step 2: Compare email addresses/usernames from LinkedIn to GitHub Step 3: Check if passwords are the same Step 4: Reset password and notify if they match
- zaroth 10y agoStep 3 is not possible without one of the following; GitHub keeps a copy of the password in plain-text GitHub keeps a copy of the SHA1 hash of the password GitHub cracks the SHA1 hash and checks against their hash GitHub calculates the SHA1 hash of the password after a valid login The 4th option is the only sane approach, but it means you can't 'Check if passwords are the same' in bulk, only as users login.
- Someone1234 10y agoThe LinkedIn dump is trivial to convert back into plain text. They're all SHA1 hashes and aren't salted. You can just download an SHA1 rainbow table[0] and instantly convert them to plain text. [0] http://project-rainbowcrack.com/table.htm http://project-rainbowcrack.com/table.htm
- jeffjose 10y agoCorrect me if I'm wrong, but rainbow table is for popular password and character combinations yes? If my password is s0m3th1nggsup33rhard, you cant make out the string from the rainbow table.
- ComodoHacker 10y agoThis is far better than TeamViewer's response to the same threat lately.
- ikeboy 10y agoI feel like sites should somehow preemptively disable passwords that have leaked publically. Is there a simple way for them to do so without downloading every leak themself? Is there a simple way for whitehats to help out? Whitehat means you can't test the site without their permission, but someone could have a database that they provide partial access to for sites without leaking and spreading it further themself? Here's an idea I just thought of: sites should have a standardized, secondary place to log in, where if the login is correct it automatically disables the password and requires a reset. "Report a compromised account", as it were. Anyone (or maybe specific whitehat groups) should have explicit permission to try any logins they want there: after all, if they succeed in logging in then the right thing happens and the account is locked. It's impossible to gain any illicit advantage from such access because any correct credentials are locked as soon as you try them. (Is this assumption robust?) So whitehats could then take lists and throw them against sites that implement this standard, but no attackers can gain from this. The only problem I see is that disabling rate limits would open you to DOS (also if multiple people use the same list, although better coordination would help solve that): maybe allow bulk uploads which take less bandwidth overall. Does this idea have any value?
- anamexis 10y agohave i been pwned has an API: https://haveibeenpwned.com/API/v2 https://haveibeenpwned.com/API/v2
- ikeboy 10y agoDoesn't help without passwords, which present some ethical problems with helping spread them especially from that site as he gets some dumps that aren't public. With my idea the people with the data would be able to directly shut down the accounts ethically. Maybe the proposal could also hash and salt the passwords before sending it to the site, which sounds even better for security and wouldn't be too much of a hassle for whitehats who want to help.
- bigiain 10y agoTroy doesn't (for very good reasons) keep the passwords or hashes from breaches - just the email address. That make his API not quite capable of doing what's proposed here - Github can't use Troy's HIBP API to detect whether a breach containing my email address included a password that authenticates with them. (And I'm not sure there's even a way to make that service without creating _way_ more security problems than it solves...)
- markokrajnc 10y agoPasswords became hard to manage... now you have to choose >>different<< password for every site... Who can remember all those passwords? Only a password manager...
- eximius 10y agoWe need to ditch passwords, not continue to proliferate them with sandboxed databases.
- voidz 10y agoYeah? What kind of a secret can replace a password/passphrase? Not biometrics, those are username replacements, not password replacements.
- WillAbides 10y agoChip implants
- ascagnel_ 10y agoHow would that differ as a means of verification? It's not a known secret, just a different way of identification.
- milesokeefe 10y agoNot if the implant is writable. The xNT 13.56mhz NTAG216 RFID implant has 888 bytes of writable memory that could be used in this way.
- malka 10y agosmartcards would be good for this.
- marcosdumay 10y agoKeys. That are approximately equivalent to long passwords, but have a standard length, and do not need sending through the network. They are also something you have, that can be protected by a password for 2FA. But that just won't happen. So many sites can not even accept big passwords, they won't all migrating to any sane schema.
- arxanas 10y agoI got an email from Bitbucket earlier today warning me about unusual behavior on my account as a result of reused credentials. Is it an attack across several version-control services?
- ThePhysicist 10y agoI got the same mail, seems like a coordinated attack. Luckily I had 2FA enabled, I'd recommend everyone to do that as well as it protects your account in these cases. Bitbucket provides an audit log and a list of recent login sessions where you can see if your account has been accessed and if anything destructive was done to it. Github has a similar feature I think.
- deleted 10y ago[deleted]
- hallman76 10y agoI got a note over the weekend from Steam (steamguard) indicating that someone attempted to log into my account. They're hitting everything.
- brador 10y agoWhy not do a site wide reset on every account?
- finnn 10y agoProbably because the only accounts that were compromised were those dumb enough to use the same password on multiple sites, and one of those sites to be compromised.
- Ensorceled 10y agoIt doesn't scale. I'd be fucking furious if services reset my password on every site because some other people reused passwords on one site that got hacked. We'd all be dealing with password resets on a daily basis.
- Pyppe 10y agoRelated to password security: any of you guys using Chrome's ability to sync passwords to "Google cloud"? I just started using it a few weeks ago. Supposedly it uses a password to encrypt the data, but I still don't feel too confident syncing them there. On the other hand.. damn it's so convenient between multiple devices.
- geostyx 10y agoI use and love 1Password. Chrome is a terrible place to keep passwords due to what @zamalek said.
- zamalek 10y agoThere was recently a TeamViewer breach. Hackers somehow managed to access people's machines. Everything was denied and it wasn't investigated. Regardless, passwords were retrieved from Chrome. Some people lost a great deal of money. Your browser is not a competent password manager and you should stop using it for that immediately. Dashlane and LastPass make their money by keeping your passwords safe. This is far more preferable than a free browser feature. Both can sync across devices (if you pay). Sounds like you will like Dashlane for the same reasons that I do.
- praxulus 10y agoHow would LastPass protect you against another TeamViewer breach?
- zamalek 10y agoThe master password.
- lucaspiller 10y agoI assume it's the same with LastPass, but I use 1Password and that requires you to enter a master password to unlock the passwords, where as Chrome requires no extra authentication.