38 ms·

43M passwords hacked in Last.fm breach

235 points by runesoerensen 10y ago

runesoerensen 10y ago
> The number of passwords and the severity of the hack was not uncovered until today. The passwords were stored using unsalted MD5 hashing Enough said. > The most popular password pulled from the Last.fm database was 123456. Seriously, it’s 2016 people Sure, but the breach was in 2012 TechCrunch. Better article: http://www.leakedsource.com/blog/lastfm http://www.leakedsource.com/blog/lastfm
- jrowley 10y ago
  Also the bulk of the users signed before that date. [0] Last.fm is one of my favorite sites. Sad that is dying :( 0. rough heuristic: https://www.google.com/trends/explore?date=all&q=last.fm https://www.google.com/trends/explore?date=all&q=last.fm Edit: If anyone wants to add me on last.fm here is my profile! http://www.last.fm/user/joer14 http://www.last.fm/user/joer14
  - deleted 10y ago
    [deleted]
  - jrowley 10y ago
    You can get even better idea of their site growth (or lack thereof) from the above link (scroll to the bottom of the page) http://www.leakedsource.com/blog/lastfm http://www.leakedsource.com/blog/lastfm
  - rawrmaan 10y ago
    Wow! They had some great growth going on and it seemed to hit a wall hard around 2008-2009. Any idea why?
    - zippy 10y ago
      http://blog.last.fm/2009/03/24/lastfm-radio-announcement http://blog.last.fm/2009/03/24/lastfm-radio-announcement "In all other countries, listening to Last.fm Radio will soon require a subscription of €3.00 per month."
      - type0 10y ago
        And at the same time they weren't treating us as customers, more like second rate users.
    - datamart 10y ago
      Maybe this is due to Spotify starting to gain traction around that time? https://www.google.com/trends/explore?date=2004-08-01%202012-09-01&q=last.fm,spotify https://www.google.com/trends/explore?date=2004-08-01%202012...
    - NeutronBoy 10y ago
      Soundcloud launched in 2008. Spotify launched in 2008. Only a year or so after Facebook opened signups to anyone IIRC. Not exactly sure what the impact on Last.fm would have been but it evidently wasn't good.
    - anexprogrammer 10y ago
      Easy. CBS bought them late 2007. Dev and updates pretty much stopped. They limited tracks you could play directly. Then they killed radio. I'm really sad to see it die, it was better at introducing me to new artists than any other service before or since, and the radio was brilliant.
      - joecool1029 10y ago
        Oh you must have left awhile ago then. I agree they ruined the best music discovery service on the web, but even without it the site was dated but functional.. until last year. Last year CBS decided the whippersnappers needed a redesign and took out around 80% of the features and put the site into a perpetual beta state.
        rhizome 10y ago
        Could have been worse, they could have hired the guy who redid Flickr and Chowhound.
        anexprogrammer 10y ago
        Didn't really give up until they had the fabulous idea to replace direct streaming with playing poor match Youtube videos as radio. That killed radio finally and made a none functioning joke of the main reason I bought my network music player. Was mad about that as Last radio was my first choice for work listening. The site was dated as they were frozen in 2008 - After CBS bought them there was one update very soon after then the site didn't change at all until last year. Minor updates and bug fixes only. As for the update last year, pretty and vacant, doesn't bring back the things I loved about the site, but lets me see lots of pretty graphs of things I'm not interested in. I took a look at libre fm after that, but that's even more abandoned.
      - type0 10y ago
        It's tragic how corporate greed can kill such an awesome site. They wasn't even ashamed to ask for money in countries where they didn't had adverts while they were removing the features from its users.
  - sotojuan 10y ago
    How is Last.fm one of your favorite sites after that horrible redesign that erased tons of user-generated content?
    - anoonmoose 10y ago
      Because it still does exactly what I want it to do, and what I've wanted it to do since I signed up in 2004, which is keep logs of every song that I listen to. The user-generated content side of it was added after I signed up (I think?) so I don't see how I could really miss it. 230K songs since 2004. http://www.last.fm/user/ryxxui http://www.last.fm/user/ryxxui
      - voltagex_ 10y ago
        I'm annoyed that I didn't keep using it consistently. I even had it tracking usage from an offline iRiver H340 MP3 player - at the end of the day, I'd upload a database from Rockbox. http://www.last.fm/user/voltagex http://www.last.fm/user/voltagex
      - dublinben 10y ago
        You might be interested in https://libre.fm/ https://libre.fm/ if you aren't confident about the future of Last.fm. It can be used as a drop-in replacement to track your music plays.
      - GurnB 10y ago
        173K Songs since Nov 2004. http://www.last.fm/user/GurnB http://www.last.fm/user/GurnB But I took 4 or 5 years off.
    - jrowley 10y ago
      I should said "it was" one of my favorite sites. The redesign is awful. They killed the neighbors feature which was really fun.
- FT_intern 10y ago
  A blast from the past. Top email domains : 1. hotmail.com 3. yahoo.com 4. aol.com 49th most used password: Blink182
- fuzzy2 10y ago
  > Sure, but the breach was in 2012 Even in 2012, storing passwords unsalted (and probably even hashed just once) was considered bad practice. As was MD5. Bad passwords being bad passwords also goes without saying. 123456 was never a good password.
  - tripzilch 10y ago
    You don't even need a breach to hack 123456, I expect it to be in every pentester's top20 first-tries (contingent on whatever profile they have on the target, obviously).
- tonicoto 10y ago
  > The number of passwords and the severity of the hack was not uncovered until today. The passwords were stored using unsalted MD5 hashing I'm 100% sure it was known it was MD5 before, and I'm 100% sure I've seen pastebins with lots of successfully bruteforced hashes, because my password was among them. Example: https://blog.lastpass.com/2012/06/in-case-you-missed-it-change-your-last-fm-password-too.html/ https://blog.lastpass.com/2012/06/in-case-you-missed-it-chan...
xorgar831 10y ago
This is practically a startup, a service that just monitors and automatically updates your passwords as they get leaked over time.
- imaginenore 10y ago
  And when it gets hacked, everyone is truly f####d.
  - rconti 10y ago
    Did you salt that hash? I'm having a hard time brute-forcing it.
- analogmemory 10y ago
  1Password has a feature called Watchtower that can tell you if your password for each site is vulnerable.
  - ketralnis 10y ago
    Unfortunately it triggers any site that it doesn't explicitly know wasn't affected by heartbleed, which makes it trigger that vast majority of my passwords. This renders it more or less useless :(
- markdown 10y ago
  A great way for Troy Hunt to monetise https://haveibeenpwned.com/ https://haveibeenpwned.com/
AdmiralAsshat 10y ago
Speaking of Last.fm, I really wish the thing had app-specific passwords as an option. I've been shuffling between Linux music players as of late, with Scrobbling as one of my requirements. Most of them have just required a login and pass instead of using OAuth. It would be nice if last.fm let me authorize them on an app-by-app basis.
deleted 10y ago
[deleted]
StavrosK 10y ago
It looks like our current approach isn't working. What if we had each site publish its login/registration endpoints in a URL, e.g. .well-known/loginurls? Then the password manager could detect you're trying to register or log in and log you in itself, generating your password in the process. Why aren't logins machine-accessible yet?
- dogma1138 10y ago
  Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.
  - prawn 10y ago
    Who wants to be helping every relative set them up and adding to the unpaid support load? So they get mentioned in passing and then people think "Yes, I should do that" and never bother. Same thing happens with backups.
    - deleted 10y ago
      [deleted]
  - GolDDranks 10y ago
    I started using LastPass just the other day because the recent news made me nervous. It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor manager has the invalid password already saved. Some sites play tricks to discourage pasting passwords. More than once I was unable to log in LastPass's online vault because of an "temporary error". All in all, it was horrible, ergonomy-wise. I don't wonder at all why people aren't using them.
matt_wulfeck 10y ago
I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for important logins). Automatic password changing would be complimentary.
- dogma1138 10y ago
  >I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it. All you need is to do an HTTP request to change the password most sites allow that to be done in a single request, CSRF might be an issue but non single action forms are usually not protected or there is no need for that and there are ways to bypass CSRF also. For a company like 1password it wouldn't be hard to build a request profile for say Alexa 500/1000 and automatically change the passwords once a breach hits, I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.
  - allendoerfer 10y ago
    >I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry. You would benefit from open-sourcing them, so others could help you keep up with websites changing.
  - niftich 10y ago
    LastPass scripted this [1] for their product. [1] https://blog.lastpass.com/2014/12/introducing-auto-password-changing-with.html/ https://blog.lastpass.com/2014/12/introducing-auto-password-...
ramblenode 10y ago
> The passwords were stored using unsalted MD5 hashing Ouch. I guess on the bright side it won't be long before researchers have a new dataset of plaintext passwords.
Alex3917 10y ago
We really need some laws around this... Prison time for web developers that store passwords insecurely, and substantial fines for anyone whose password can be brute forced from one of these leaks.
- sosborn 10y ago
  > Prison time for web developers that store passwords insecurely What a terrible idea.
- 001spartan 10y ago
  As someone who has very strong feelings about sites not letting me choose secure passwords, or storing them insecurely...no. Fines for storing passwords insecurely and getting breached, sure. This is already handled by PCI/HIPAA, but could definitely stand to be improved. Prison time? There's no possible way that would end well. Fines for "anyone whose password can be brute forced from one of these leaks"? So that means 80% of people out there would be given "substantial fines". Not going to happen.
  - Alex3917 10y ago
    > So that means 80% of people out there would be given "substantial fines". Not going to happen. How is that any different than giving speeding tickets? If you behave recklessly in a way that puts others at risk, you should have to make restitution to society.
    - runesoerensen 10y ago
      Hmm not sure I understand your reasoning here.. You don't think there's a difference between speeding and choosing a weak password for a site like last.fm? The latter might be a bit silly, but how does it put others at risk?
      - Alex3917 10y ago
        With the Dropbox hack for example, the reason they got hacked is because one of their employees reused a password, presumably from another site that got hacked. So that's one vector, where every time a site gets hacked, people using weak passwords (and reusing them) create the risk of future hacks. But more generally, exposing your account credentials allows others to impersonate you and potentially scam others, expose the data of others, etc. In the case of Last.fm there obviously isn't a ton of potential for abuse directly, other than maybe firing off fake song plays to pocket the royalties, but the potential for greater harm exists in the general case. E.g. consider the enormous percentage of credit card transactions that are fraudulent, largely because of scammers using PII that's stolen in these large scale hacks. That absolutely effects the fees and interest rates for everyone else using banks in any way, so even if your own identity isn't stolen you're absolutely still affected. And even in some hypothetical scenario where the only person harmed would be the person using the weak password, there is still precedent for regulation because we have laws requiring people to wear bike helmets, preventing kids from smoking, etc.
NamTaf 10y ago
I spent 3 days off work a few weeks ago watching the Dota International and spent the whole time searching through my emails for 'account', 'registration', etc. trying to find everything I'd ever signed up to and finally move it all to a password manager because I really knew better and was lazy for the past several years. It took 3 days of like 6 hours a day half doing this to update all that I could think of and find. That ended up being about 150 passwords in total. Even still, I missed last.fm and probably a whole host of other ones that I'll never remember. Passwords are a goddamn nightmare.
transfire 10y ago
Please get rid of passwords. Thanks.
- bigiain 10y ago
  I don't know who's downvoting you - but this is a really important idea. As a new curious user of your new startup's website, I don't give a damn about being "secure". I've probably given you a fake name and a stupid password just so I can poke around and see if your site sucks any less than the other 5 or 6 new sites desperately craving my attention this morning. If I can get in and look around without having to lie about my personal details - you're _way_ more likely to get a"proper password" and my real contact details if/when I decide I'm actually gonna add you the the list of "stuff I use" instead of "crap I signed up for once and never went back again" or "site I used a few times but none of my friends signed up so I stopped going there".
  - bschwindHN 10y ago
    Probably getting downvoted because these comments are common and don't make any suggestions on how to get rid of passwords.
- kuschku 10y ago
  OpenID was a solution for that, but it got turned into this horrible thing that is OAuth2. Mozilla Persona could have been another solution – just log in with your browser account – but that got killed. And in the current web, I’m not sure something like that will ever happen, as the web is moving even more away from universal standards, and towards more and more closed walled gardens.
bigiain 10y ago
Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook/internet-banking password. The answer isn't to try and force "good passwords" from users who don't care. Remember, by definition - they don't care. We need to start trying to not require users to come up with passwords until they do care. Maybe just cookie me and let me tromp around as an unauthenticated user until I do something that needs me to set up a password-protected account. Maybe ask for my email and send me a login link that hooks me into my account/data without me setting a password (lets face it, your password security is going to fundamentally rely on the security of my email account, 'cause your "forgot password" story says you'll happily send a password rest link there, right? I know Start-up-de-jour desperately needs "signed up user numbers" for their investor pitch, but that's not going to motivate me to stop using 123456 or password123 as a password when startupdejour.io demands I create an account just to look around.
- grrowl 10y ago
  Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.
  - jcrites 10y ago
    It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for when these messages arrive. When the site they're visiting indicates through its web page that, "I'm trying to authenticate you by email", then the browser can fetch recent incoming messages of this type, then parse them and display UI chrome like "Xyz.example.com wants to authenticate you". You click a button to log in passwordlessly, which involves sending an HTTP request to a link specified in the email. Coordination occurs on the server side and the login is allowed. There are probably some details I'm not considering, but it doesn't seem like it'd be too hard to build a prototype, and if standardized and deployed it would eliminate the need for passwords. I gather that Mozilla Persona works along similar lines, though I confess to not knowing the exact details. There would be practical difficulties integrating all of these things together, though: email, browser, and website login, and gaining adoption in the real world. There are also sites that don't require email on signup, but this feature could be supported only for people who want to supply email. The email address used for this feature could also be a different technical address unrelated to the primary mailbox, where only login requests are sent. This could also help expedite the email traffic to ensure it's real-time. The browser could automatically fill in the email address when challenged by a website supporting this login method. Alternatively, perhaps a browser vendor could introduce a de facto standard where sites can integrate via an API with the browser's password safe features. Chrome can save passwords and synchronize them across devices. Maybe it wouldn't be too hard for sites to comply with a microformat that helps the browser understand when to generate a password on signup, and when to provide it, etc.
kevin_thibedeau 10y ago
It would be nice if the EU would do something useful like require all sites to hash salted passwords and prohibit the use of weak hashes for new accounts. Instead we get the ridiculous cookie nag.
- daphinz 10y ago
  How would you regulate that? Wouldn't that suggest that the EU would have some sort of access to private back-ends in order to check?
  - ryanlol 10y ago
    ... Just like you'd regulate anything else?
- hkjgkjy 10y ago
  Being European and computer literate, I hope the EU stops creating stupid and pointless internet laws
  - angry-hacker 10y ago
    Another vote from a fellow European to keep Brussel bureaucrats out of internet. They have no clue or somehow good intentions always turn our horrible. An old saying about countries that can't get together a government (like ironically Belgium!) - - it's the best for the people for having a country without the government because then they can't make more stupid laws.
pwinnski 10y ago
Hmm, I used to use last.fm, better change my password. Hmm, 1Password shows I was using a generated unique password, so that's good, though it wasn't as long and complicated as the ones I use now. And this password was generated June 7, 2012. Wait, when was the hack again? March 22, 2012. Ah, looks like I was covered. But hey, now it's an even longer password with even higher entropy, so that's not a bad thing.
yladiz 10y ago
Man, I'm getting desensitized to the enormous numbers of accounts whose information gets leaked when a platform gets hacked. 43 million here, 68 million there. I'm semi-joking, but at this point it's almost like I need Facebook or Google level hacks (multiple hundred millions or billions) to actually think, "This is huge."
- elliotec 10y ago
  I've been thinking that for a while, but also how come it's never me? I've had accounts with several hacked systems and sure I try to have pretty strong passwords but... I appear to be safe every time. Famous last words maybe, but then I'll just change my password?
  - yladiz 10y ago
    You may appear safe but you never know... Services like Google and Facebook are pretty proactive about making sure unknown users can't access your account easily -- meaning that if someone from Thailand tried to access your account when you usually use it in the US from an unknown device, it'll generally not allow the login. But other services aren't as proactive and may be compromised, so it's definitely better to be safe. The best way is to use unique passwords for every service (or use OAuth with a service provider you trust), and a simple way to do that is with a password manager. I personally recommend 1password, because they haven't had vulnerability issues like LastPass and don't store passwords in their cloud, but they store it in "your" cloud, e.g. iCloud, Dropbox, and it works very well on iPhone. But at the minimum just using a separate password for everything is the best way to mitigate these kinds of issues.
    - chmars 10y ago
      1Password is moving to its own cloud service … although you can still use the traditional app with third party syncing for now.
      - yladiz 10y ago
tudorw 10y ago
shit, my musical taste laid bare for all to see, better start packing...
Xorlev 10y ago
2012 was a good year. Fine vintage passwords.
Artoemius 10y ago
Is there a reason to have a password other than 123456 on last.fm?
xuejie 10y ago
Yes, we could argue that user should use more secure password, but on the other hand, I always wonder why startups these days are still busy rolling out their own custom account management than leveraging OAuth or hosted solution like Auth0. Seriously, in how many cases do we have a feature that is so unique that is not available via these alternative solutions? Even though I have 1password setup, I would be so reluctant to create new passwords, I'm more willing to use OAuth whenever I can.
DangerDOOM 10y ago
>Hashing is a method for encrypting data No it isn't. > MD5 is seriously out of style That's, err, one way of putting it. > The most popular password pulled from the Last.fm database was 123456. L Seriously, it’s 2016 people These accounts were made more than four years ago... > use a platform like LastPass Yeah about that... https://news.ycombinator.com/item?id=9721212 https://news.ycombinator.com/item?id=9721212 Poor reporting is poor. Why do I expect more from TechCrunch?
- Sammi 10y ago
  Md5crypt Password scrambler is no longer considered safe by author: http://phk.freebsd.dk/sagas/md5crypt_eol.html http://phk.freebsd.dk/sagas/md5crypt_eol.html Also a better way to explain hashing algorithms to the lay person is to call them fingerprinting algorithms.
brian-armstrong 10y ago
123456 is actually a /fantastic/ password if you don't care what happens to the account. If you aren't going to the trouble of using a password manager, and the account doesn't mean much to you, then using weak passwords like this rather than your "good" password is a great idea. Save the entropy for your email and bank accounts.
- atdt 10y ago
  I see your point, but 123456 is still a stupid password. A brain-dead password scheme like "1 <NameOfMyCat> <Domain>" (e.g., "1 Snuggles last.fm") is just as easy to remember, won't show up in rainbow tables, is nominally difficult to brute force, and you're more likely to be able to use it, as opposed to '123456', which many sites will balk at. (To be clear: I am not endorsing this scheme. It is superior to '123456', but it is still bone-headed.)
  - vidarh 10y ago
    The point is that you should only use this kind of password in places where you really do not care about someone else getting access. It doesn't really matter what it is. It matters that it's something you're not for a moment tempted to think of as a "real" password and that you would never dream of using for any account where a data leak would affect you, but merely as a "they're stupidly asking me for a password for an account I don't care about, so lets just give them this" token. I'd lean towards agreeing with you that it's better to pick something else, but only to slightly reduce the inconvenience of someone messing with your account "just because".
- theandrewbailey 10y ago
  "Saving" entropy is ridiculous. It is literally everywhere, always growing, and can be called up on demand. Random password generators are a thing.
- eeeeeeeeeeeee 10y ago
  123456 is literally in the top 10 list of worst passwords. You might as well not have any password at all. I agree that your banks and sensitive logins should have the better passwords, but you can have a decent password, it be memorable, and it still do its job on services you don't care as much about.
naibafo 10y ago
On that note I was just reminded that I could delete my account since I am not using it anyways anymore. Apparently they removed that option very recently and now you can only 'close' it, which hides it but doesn't ever deletes it. :/
amq 10y ago
Is it really that difficult to upgrade all passwords with something like bcrypt(original md5)?
- theandrewbailey 10y ago
  It's not that it's difficult; it's not a good idea. It does not increase randomness (entropy), and would probably decrease it. In that situation, update the hash with a new method upon login.
unicornporn 10y ago
[NSFW] "Nothing Better Than Gay Sex" https://i.imgur.com/PsRAsLi.jpg https://i.imgur.com/PsRAsLi.jpg Nothing wrong with the message per se, but has the site been defaced too?
- dgnrjrrnfn 10y ago
  Posted four hours ago! Last.fm is truly on its last legs.
nly 10y ago
We've had zero knowledge password authentication protocols for 20 years. At this point, any pain and suffering from these leaks is blood on the hands of browser vendors and web standards bodies.
LinuxFreedom 10y ago
Recommending a closed source cloud service to send all your passwords to in a thread on HN about a closed source cloud service that lost all passwords is a great way to demonstrate deep and fundamental knowledge about the principles of software security!
guard-of-terra 10y ago
New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~, or a space There's no way I'll remember a last.fm password like that! :(
- kodt 10y ago
  Password managers are a must these days.
  - guard-of-terra 10y ago
    I have several devices and enjoy being sometimes login on stray device I don't own.
- mikestew 10y ago
  You can't remember kFourLetterNameOfYourCat + "1!"?
josteink 10y ago
> it’s 2016 people — use a platform like LastPass to generate randomized, complex passwords that are unique to every service for which you sign up. Another way to read this statement is that passwords simply doesn't work. We need something different. Something better. And from the comments we find this: > I am a bit confused. The article states that this happened in 2012, why is it posted today? Something happened in relation to this breach? I think this also needs much better clarification. What has happened since 2012 which makes this newsworth now? And where is the LeakedSource report they cite but never link to? Where can I get more info? This is very bad reporting.
- chriswarbo 10y ago
  > The number of passwords and the severity of the hack were not uncovered until today. The passwords were stored using unsalted MD5 hashing.
fahrradflucht 10y ago
Wow it's 2016 and Last.fm still isn't on HTTPS for anything other then login. And the "new frontend" is in beta for around a year IIRC...
Naga 10y ago
Maybe now I can get access to my account. I forgot my password and tried to jump through their hoops to reaccess my account. They involved calling the support department during business hours. It was the holiday season, so I just gave up.
finchisko 10y ago
The tragicomic part is how they enforcing password complexity: Your password is not strong enough. New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~, or a space So password efZeLmur3ivio4t7 is not safe enough to be used by last.fm and they use md5 without salt to protect it?
- lquas 10y ago
  This was in 2012. Their password enforcement policies were most likely different back then.
- nathanaldensr 10y ago
  A password that follows that "security scheme" is pass1!, which KeePass 2 reports as having a quality of 18 bits. efZeLmur3ivio4t7, an illegal password, has a quality of 86 bits. Whoever was responsible for that decision should be fired. Either implement a real password strength algorithm based on entropy, or don't implement any except maybe minimum length.
  - finchisko 10y ago
    not just fired, but shot dead :-)
deleted 10y ago
[deleted]
CWuestefeld 10y ago
Question about password best practices. Our site just went through pen testing, as part of auditing for PCI compliance. One thing we got dinged on was that we don't keep a password history, so that the user can't revert to their previous password. The tester's report said, "This, in turn, results in users utilizing a single password for a long period of time, which may result in password disclosure" It seems to me that this is the opposite of the truth. If I'm keeping a password history, then in the event of a breach, there is that much more data that would leaking, potentially disclosing password data if we made a mistake in the rest of how we handle it (hashing, etc.). And while I'm not a crypto expert at all, it seems to me that if there's a list of salted, hashed passwords, then given that the salt is a constant per user, an attacker would have some leg up in discovering the original password if there were many samples that included the same salt. If I want to minimize the data I can disclose about users, I ought to minimize the amount of data that I'm storing about them.
- Flenser 10y ago
  "given that the salt is a constant per user" Just use a different salt for each password, not each user Edit: You're probably right about everything else.
- vidarh 10y ago
  Consider that leaking their past passwords only matters if they reuse them elsewhere. If they reuse passwords, then chances are you will expose them just as much if you don't force them to rotate passwords, when they end up putting their password into a scam site or run by people who store plain text. And if you don't check for reuse, you are not forcing them to rotate passwords. In the face of that, you can't do much better than to make it harder for them to keep reusing passwords on your site so at least a password leak elsewhere won't expose their account with you. (And re-using the salt is a mistake; don't do that)
- tombert 10y ago
  PCI Compliance is kind of arbitrary. I once worked for a company that kept all their passwords in plain text, and still managed to get compliance. I was just an intern at the time, and I still thought that was kind of weird, especially since this was around 2011 and not the mid-90's.
arrty88 10y ago
can someone please make a startup that upgrades unsalted md5 passwords to something better
DeAndre222 10y ago
I know a real professional hacker who has worked for me twice in the past one month. He is very good at hacking anything concerning database, phone, social media and even credit report fixes. He offers legit services. He also helps to retrieve accounts that have been taken by hackers. Contact him at Alphafasttunnel247@cyberservices.com or text him at +1 646 480 9658

235 points by runesoerensen 10y ago

> The number of passwords and the severity of the hack was not uncovered until today. The passwords were stored using unsalted MD5 hashing Enough said. > The most popular password pulled from the Last.fm database was 123456. Seriously, it’s 2016 people Sure, but the breach was in 2012 TechCrunch. Better article: http://www.leakedsource.com/blog/lastfm http://www.leakedsource.com/blog/lastfm

jrowley 10y ago
Also the bulk of the users signed before that date. [0] Last.fm is one of my favorite sites. Sad that is dying :( 0. rough heuristic: https://www.google.com/trends/explore?date=all&q=last.fm https://www.google.com/trends/explore?date=all&q=last.fm Edit: If anyone wants to add me on last.fm here is my profile! http://www.last.fm/user/joer14 http://www.last.fm/user/joer14
- deleted 10y ago
  [deleted]
- jrowley 10y ago
  You can get even better idea of their site growth (or lack thereof) from the above link (scroll to the bottom of the page) http://www.leakedsource.com/blog/lastfm http://www.leakedsource.com/blog/lastfm
- rawrmaan 10y ago
  Wow! They had some great growth going on and it seemed to hit a wall hard around 2008-2009. Any idea why?
  - zippy 10y ago
    http://blog.last.fm/2009/03/24/lastfm-radio-announcement http://blog.last.fm/2009/03/24/lastfm-radio-announcement "In all other countries, listening to Last.fm Radio will soon require a subscription of €3.00 per month."
    - type0 10y ago
      And at the same time they weren't treating us as customers, more like second rate users.
  - datamart 10y ago
    Maybe this is due to Spotify starting to gain traction around that time? https://www.google.com/trends/explore?date=2004-08-01%202012-09-01&q=last.fm,spotify https://www.google.com/trends/explore?date=2004-08-01%202012...
  - NeutronBoy 10y ago
    Soundcloud launched in 2008. Spotify launched in 2008. Only a year or so after Facebook opened signups to anyone IIRC. Not exactly sure what the impact on Last.fm would have been but it evidently wasn't good.
  - anexprogrammer 10y ago
    Easy. CBS bought them late 2007. Dev and updates pretty much stopped. They limited tracks you could play directly. Then they killed radio. I'm really sad to see it die, it was better at introducing me to new artists than any other service before or since, and the radio was brilliant.
    - joecool1029 10y ago
      Oh you must have left awhile ago then. I agree they ruined the best music discovery service on the web, but even without it the site was dated but functional.. until last year. Last year CBS decided the whippersnappers needed a redesign and took out around 80% of the features and put the site into a perpetual beta state.
      - rhizome 10y ago
        Could have been worse, they could have hired the guy who redid Flickr and Chowhound.
      - anexprogrammer 10y ago
        Didn't really give up until they had the fabulous idea to replace direct streaming with playing poor match Youtube videos as radio. That killed radio finally and made a none functioning joke of the main reason I bought my network music player. Was mad about that as Last radio was my first choice for work listening. The site was dated as they were frozen in 2008 - After CBS bought them there was one update very soon after then the site didn't change at all until last year. Minor updates and bug fixes only. As for the update last year, pretty and vacant, doesn't bring back the things I loved about the site, but lets me see lots of pretty graphs of things I'm not interested in. I took a look at libre fm after that, but that's even more abandoned.
    - type0 10y ago
      It's tragic how corporate greed can kill such an awesome site. They wasn't even ashamed to ask for money in countries where they didn't had adverts while they were removing the features from its users.
- sotojuan 10y ago
  How is Last.fm one of your favorite sites after that horrible redesign that erased tons of user-generated content?
  - anoonmoose 10y ago
    Because it still does exactly what I want it to do, and what I've wanted it to do since I signed up in 2004, which is keep logs of every song that I listen to. The user-generated content side of it was added after I signed up (I think?) so I don't see how I could really miss it. 230K songs since 2004. http://www.last.fm/user/ryxxui http://www.last.fm/user/ryxxui
    - voltagex_ 10y ago
      I'm annoyed that I didn't keep using it consistently. I even had it tracking usage from an offline iRiver H340 MP3 player - at the end of the day, I'd upload a database from Rockbox. http://www.last.fm/user/voltagex http://www.last.fm/user/voltagex
    - dublinben 10y ago
      You might be interested in https://libre.fm/ https://libre.fm/ if you aren't confident about the future of Last.fm. It can be used as a drop-in replacement to track your music plays.
    - GurnB 10y ago
      173K Songs since Nov 2004. http://www.last.fm/user/GurnB http://www.last.fm/user/GurnB But I took 4 or 5 years off.
  - jrowley 10y ago
    I should said "it was" one of my favorite sites. The redesign is awful. They killed the neighbors feature which was really fun.
FT_intern 10y ago
A blast from the past. Top email domains : 1. hotmail.com 3. yahoo.com 4. aol.com 49th most used password: Blink182
fuzzy2 10y ago
> Sure, but the breach was in 2012 Even in 2012, storing passwords unsalted (and probably even hashed just once) was considered bad practice. As was MD5. Bad passwords being bad passwords also goes without saying. 123456 was never a good password.
- tripzilch 10y ago
  You don't even need a breach to hack 123456, I expect it to be in every pentester's top20 first-tries (contingent on whatever profile they have on the target, obviously).
tonicoto 10y ago
> The number of passwords and the severity of the hack was not uncovered until today. The passwords were stored using unsalted MD5 hashing I'm 100% sure it was known it was MD5 before, and I'm 100% sure I've seen pastebins with lots of successfully bruteforced hashes, because my password was among them. Example: https://blog.lastpass.com/2012/06/in-case-you-missed-it-change-your-last-fm-password-too.html/ https://blog.lastpass.com/2012/06/in-case-you-missed-it-chan...

xorgar831 10y ago

This is practically a startup, a service that just monitors and automatically updates your passwords as they get leaked over time.

imaginenore 10y ago
And when it gets hacked, everyone is truly f####d.
- rconti 10y ago
  Did you salt that hash? I'm having a hard time brute-forcing it.
analogmemory 10y ago
1Password has a feature called Watchtower that can tell you if your password for each site is vulnerable.
- ketralnis 10y ago
  Unfortunately it triggers any site that it doesn't explicitly know wasn't affected by heartbleed, which makes it trigger that vast majority of my passwords. This renders it more or less useless :(
markdown 10y ago
A great way for Troy Hunt to monetise https://haveibeenpwned.com/ https://haveibeenpwned.com/

AdmiralAsshat 10y ago

Speaking of Last.fm, I really wish the thing had app-specific passwords as an option. I've been shuffling between Linux music players as of late, with Scrobbling as one of my requirements. Most of them have just required a login and pass instead of using OAuth. It would be nice if last.fm let me authorize them on an app-by-app basis.

deleted 10y ago

[deleted]

StavrosK 10y ago

It looks like our current approach isn't working. What if we had each site publish its login/registration endpoints in a URL, e.g. .well-known/loginurls? Then the password manager could detect you're trying to register or log in and log you in itself, generating your password in the process. Why aren't logins machine-accessible yet?

dogma1138 10y ago
Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.
- prawn 10y ago
  Who wants to be helping every relative set them up and adding to the unpaid support load? So they get mentioned in passing and then people think "Yes, I should do that" and never bother. Same thing happens with backups.
  - deleted 10y ago
    [deleted]
- GolDDranks 10y ago
  I started using LastPass just the other day because the recent news made me nervous. It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor manager has the invalid password already saved. Some sites play tricks to discourage pasting passwords. More than once I was unable to log in LastPass's online vault because of an "temporary error". All in all, it was horrible, ergonomy-wise. I don't wonder at all why people aren't using them.

matt_wulfeck 10y ago

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for important logins). Automatic password changing would be complimentary.

dogma1138 10y ago
>I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it. All you need is to do an HTTP request to change the password most sites allow that to be done in a single request, CSRF might be an issue but non single action forms are usually not protected or there is no need for that and there are ways to bypass CSRF also. For a company like 1password it wouldn't be hard to build a request profile for say Alexa 500/1000 and automatically change the passwords once a breach hits, I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.
- allendoerfer 10y ago
  >I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry. You would benefit from open-sourcing them, so others could help you keep up with websites changing.
- niftich 10y ago
  LastPass scripted this [1] for their product. [1] https://blog.lastpass.com/2014/12/introducing-auto-password-changing-with.html/ https://blog.lastpass.com/2014/12/introducing-auto-password-...

ramblenode 10y ago

> The passwords were stored using unsalted MD5 hashing Ouch. I guess on the bright side it won't be long before researchers have a new dataset of plaintext passwords.

Alex3917 10y ago

We really need some laws around this... Prison time for web developers that store passwords insecurely, and substantial fines for anyone whose password can be brute forced from one of these leaks.

sosborn 10y ago
> Prison time for web developers that store passwords insecurely What a terrible idea.
001spartan 10y ago
As someone who has very strong feelings about sites not letting me choose secure passwords, or storing them insecurely...no. Fines for storing passwords insecurely and getting breached, sure. This is already handled by PCI/HIPAA, but could definitely stand to be improved. Prison time? There's no possible way that would end well. Fines for "anyone whose password can be brute forced from one of these leaks"? So that means 80% of people out there would be given "substantial fines". Not going to happen.
- Alex3917 10y ago
  > So that means 80% of people out there would be given "substantial fines". Not going to happen. How is that any different than giving speeding tickets? If you behave recklessly in a way that puts others at risk, you should have to make restitution to society.
  - runesoerensen 10y ago
    Hmm not sure I understand your reasoning here.. You don't think there's a difference between speeding and choosing a weak password for a site like last.fm? The latter might be a bit silly, but how does it put others at risk?
    - Alex3917 10y ago
      With the Dropbox hack for example, the reason they got hacked is because one of their employees reused a password, presumably from another site that got hacked. So that's one vector, where every time a site gets hacked, people using weak passwords (and reusing them) create the risk of future hacks. But more generally, exposing your account credentials allows others to impersonate you and potentially scam others, expose the data of others, etc. In the case of Last.fm there obviously isn't a ton of potential for abuse directly, other than maybe firing off fake song plays to pocket the royalties, but the potential for greater harm exists in the general case. E.g. consider the enormous percentage of credit card transactions that are fraudulent, largely because of scammers using PII that's stolen in these large scale hacks. That absolutely effects the fees and interest rates for everyone else using banks in any way, so even if your own identity isn't stolen you're absolutely still affected. And even in some hypothetical scenario where the only person harmed would be the person using the weak password, there is still precedent for regulation because we have laws requiring people to wear bike helmets, preventing kids from smoking, etc.

NamTaf 10y ago

I spent 3 days off work a few weeks ago watching the Dota International and spent the whole time searching through my emails for 'account', 'registration', etc. trying to find everything I'd ever signed up to and finally move it all to a password manager because I really knew better and was lazy for the past several years. It took 3 days of like 6 hours a day half doing this to update all that I could think of and find. That ended up being about 150 passwords in total. Even still, I missed last.fm and probably a whole host of other ones that I'll never remember. Passwords are a goddamn nightmare.

transfire 10y ago

Please get rid of passwords. Thanks.

bigiain 10y ago
I don't know who's downvoting you - but this is a really important idea. As a new curious user of your new startup's website, I don't give a damn about being "secure". I've probably given you a fake name and a stupid password just so I can poke around and see if your site sucks any less than the other 5 or 6 new sites desperately craving my attention this morning. If I can get in and look around without having to lie about my personal details - you're _way_ more likely to get a"proper password" and my real contact details if/when I decide I'm actually gonna add you the the list of "stuff I use" instead of "crap I signed up for once and never went back again" or "site I used a few times but none of my friends signed up so I stopped going there".
- bschwindHN 10y ago
  Probably getting downvoted because these comments are common and don't make any suggestions on how to get rid of passwords.
kuschku 10y ago
OpenID was a solution for that, but it got turned into this horrible thing that is OAuth2. Mozilla Persona could have been another solution – just log in with your browser account – but that got killed. And in the current web, I’m not sure something like that will ever happen, as the web is moving even more away from universal standards, and towards more and more closed walled gardens.

bigiain 10y ago

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook/internet-banking password. The answer isn't to try and force "good passwords" from users who don't care. Remember, by definition - they don't care. We need to start trying to not require users to come up with passwords until they do care. Maybe just cookie me and let me tromp around as an unauthenticated user until I do something that needs me to set up a password-protected account. Maybe ask for my email and send me a login link that hooks me into my account/data without me setting a password (lets face it, your password security is going to fundamentally rely on the security of my email account, 'cause your "forgot password" story says you'll happily send a password rest link there, right? I know Start-up-de-jour desperately needs "signed up user numbers" for their investor pitch, but that's not going to motivate me to stop using 123456 or password123 as a password when startupdejour.io demands I create an account just to look around.

grrowl 10y ago
Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.
- jcrites 10y ago
  It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for when these messages arrive. When the site they're visiting indicates through its web page that, "I'm trying to authenticate you by email", then the browser can fetch recent incoming messages of this type, then parse them and display UI chrome like "Xyz.example.com wants to authenticate you". You click a button to log in passwordlessly, which involves sending an HTTP request to a link specified in the email. Coordination occurs on the server side and the login is allowed. There are probably some details I'm not considering, but it doesn't seem like it'd be too hard to build a prototype, and if standardized and deployed it would eliminate the need for passwords. I gather that Mozilla Persona works along similar lines, though I confess to not knowing the exact details. There would be practical difficulties integrating all of these things together, though: email, browser, and website login, and gaining adoption in the real world. There are also sites that don't require email on signup, but this feature could be supported only for people who want to supply email. The email address used for this feature could also be a different technical address unrelated to the primary mailbox, where only login requests are sent. This could also help expedite the email traffic to ensure it's real-time. The browser could automatically fill in the email address when challenged by a website supporting this login method. Alternatively, perhaps a browser vendor could introduce a de facto standard where sites can integrate via an API with the browser's password safe features. Chrome can save passwords and synchronize them across devices. Maybe it wouldn't be too hard for sites to comply with a microformat that helps the browser understand when to generate a password on signup, and when to provide it, etc.

kevin_thibedeau 10y ago

It would be nice if the EU would do something useful like require all sites to hash salted passwords and prohibit the use of weak hashes for new accounts. Instead we get the ridiculous cookie nag.

daphinz 10y ago
How would you regulate that? Wouldn't that suggest that the EU would have some sort of access to private back-ends in order to check?
- ryanlol 10y ago
  ... Just like you'd regulate anything else?
hkjgkjy 10y ago
Being European and computer literate, I hope the EU stops creating stupid and pointless internet laws
- angry-hacker 10y ago
  Another vote from a fellow European to keep Brussel bureaucrats out of internet. They have no clue or somehow good intentions always turn our horrible. An old saying about countries that can't get together a government (like ironically Belgium!) - - it's the best for the people for having a country without the government because then they can't make more stupid laws.

pwinnski 10y ago

Hmm, I used to use last.fm, better change my password. Hmm, 1Password shows I was using a generated unique password, so that's good, though it wasn't as long and complicated as the ones I use now. And this password was generated June 7, 2012. Wait, when was the hack again? March 22, 2012. Ah, looks like I was covered. But hey, now it's an even longer password with even higher entropy, so that's not a bad thing.

yladiz 10y ago

Man, I'm getting desensitized to the enormous numbers of accounts whose information gets leaked when a platform gets hacked. 43 million here, 68 million there. I'm semi-joking, but at this point it's almost like I need Facebook or Google level hacks (multiple hundred millions or billions) to actually think, "This is huge."

elliotec 10y ago
I've been thinking that for a while, but also how come it's never me? I've had accounts with several hacked systems and sure I try to have pretty strong passwords but... I appear to be safe every time. Famous last words maybe, but then I'll just change my password?
- yladiz 10y ago
  You may appear safe but you never know... Services like Google and Facebook are pretty proactive about making sure unknown users can't access your account easily -- meaning that if someone from Thailand tried to access your account when you usually use it in the US from an unknown device, it'll generally not allow the login. But other services aren't as proactive and may be compromised, so it's definitely better to be safe. The best way is to use unique passwords for every service (or use OAuth with a service provider you trust), and a simple way to do that is with a password manager. I personally recommend 1password, because they haven't had vulnerability issues like LastPass and don't store passwords in their cloud, but they store it in "your" cloud, e.g. iCloud, Dropbox, and it works very well on iPhone. But at the minimum just using a separate password for everything is the best way to mitigate these kinds of issues.
  - chmars 10y ago
    1Password is moving to its own cloud service … although you can still use the traditional app with third party syncing for now.
    - yladiz 10y ago

tudorw 10y ago

shit, my musical taste laid bare for all to see, better start packing...

Xorlev 10y ago

2012 was a good year. Fine vintage passwords.

Artoemius 10y ago

Is there a reason to have a password other than 123456 on last.fm?

xuejie 10y ago

Yes, we could argue that user should use more secure password, but on the other hand, I always wonder why startups these days are still busy rolling out their own custom account management than leveraging OAuth or hosted solution like Auth0. Seriously, in how many cases do we have a feature that is so unique that is not available via these alternative solutions? Even though I have 1password setup, I would be so reluctant to create new passwords, I'm more willing to use OAuth whenever I can.

DangerDOOM 10y ago

>Hashing is a method for encrypting data No it isn't. > MD5 is seriously out of style That's, err, one way of putting it. > The most popular password pulled from the Last.fm database was 123456. L Seriously, it’s 2016 people These accounts were made more than four years ago... > use a platform like LastPass Yeah about that... https://news.ycombinator.com/item?id=9721212 https://news.ycombinator.com/item?id=9721212 Poor reporting is poor. Why do I expect more from TechCrunch?

Sammi 10y ago
Md5crypt Password scrambler is no longer considered safe by author: http://phk.freebsd.dk/sagas/md5crypt_eol.html http://phk.freebsd.dk/sagas/md5crypt_eol.html Also a better way to explain hashing algorithms to the lay person is to call them fingerprinting algorithms.

brian-armstrong 10y ago

123456 is actually a /fantastic/ password if you don't care what happens to the account. If you aren't going to the trouble of using a password manager, and the account doesn't mean much to you, then using weak passwords like this rather than your "good" password is a great idea. Save the entropy for your email and bank accounts.

atdt 10y ago
I see your point, but 123456 is still a stupid password. A brain-dead password scheme like "1 <NameOfMyCat> <Domain>" (e.g., "1 Snuggles last.fm") is just as easy to remember, won't show up in rainbow tables, is nominally difficult to brute force, and you're more likely to be able to use it, as opposed to '123456', which many sites will balk at. (To be clear: I am not endorsing this scheme. It is superior to '123456', but it is still bone-headed.)
- vidarh 10y ago
  The point is that you should only use this kind of password in places where you really do not care about someone else getting access. It doesn't really matter what it is. It matters that it's something you're not for a moment tempted to think of as a "real" password and that you would never dream of using for any account where a data leak would affect you, but merely as a "they're stupidly asking me for a password for an account I don't care about, so lets just give them this" token. I'd lean towards agreeing with you that it's better to pick something else, but only to slightly reduce the inconvenience of someone messing with your account "just because".
theandrewbailey 10y ago
"Saving" entropy is ridiculous. It is literally everywhere, always growing, and can be called up on demand. Random password generators are a thing.
eeeeeeeeeeeee 10y ago
123456 is literally in the top 10 list of worst passwords. You might as well not have any password at all. I agree that your banks and sensitive logins should have the better passwords, but you can have a decent password, it be memorable, and it still do its job on services you don't care as much about.

naibafo 10y ago

On that note I was just reminded that I could delete my account since I am not using it anyways anymore. Apparently they removed that option very recently and now you can only 'close' it, which hides it but doesn't ever deletes it. :/

amq 10y ago

Is it really that difficult to upgrade all passwords with something like bcrypt(original md5)?

theandrewbailey 10y ago
It's not that it's difficult; it's not a good idea. It does not increase randomness (entropy), and would probably decrease it. In that situation, update the hash with a new method upon login.

unicornporn 10y ago

[NSFW] "Nothing Better Than Gay Sex" https://i.imgur.com/PsRAsLi.jpg https://i.imgur.com/PsRAsLi.jpg Nothing wrong with the message per se, but has the site been defaced too?

dgnrjrrnfn 10y ago
Posted four hours ago! Last.fm is truly on its last legs.

nly 10y ago

We've had zero knowledge password authentication protocols for 20 years. At this point, any pain and suffering from these leaks is blood on the hands of browser vendors and web standards bodies.

LinuxFreedom 10y ago

Recommending a closed source cloud service to send all your passwords to in a thread on HN about a closed source cloud service that lost all passwords is a great way to demonstrate deep and fundamental knowledge about the principles of software security!

guard-of-terra 10y ago

New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~, or a space There's no way I'll remember a last.fm password like that! :(

kodt 10y ago
Password managers are a must these days.
- guard-of-terra 10y ago
  I have several devices and enjoy being sometimes login on stray device I don't own.
mikestew 10y ago
You can't remember kFourLetterNameOfYourCat + "1!"?

josteink 10y ago

> it’s 2016 people — use a platform like LastPass to generate randomized, complex passwords that are unique to every service for which you sign up. Another way to read this statement is that passwords simply doesn't work. We need something different. Something better. And from the comments we find this: > I am a bit confused. The article states that this happened in 2012, why is it posted today? Something happened in relation to this breach? I think this also needs much better clarification. What has happened since 2012 which makes this newsworth now? And where is the LeakedSource report they cite but never link to? Where can I get more info? This is very bad reporting.

chriswarbo 10y ago
> The number of passwords and the severity of the hack were not uncovered until today. The passwords were stored using unsalted MD5 hashing.

fahrradflucht 10y ago

Wow it's 2016 and Last.fm still isn't on HTTPS for anything other then login. And the "new frontend" is in beta for around a year IIRC...

Naga 10y ago

Maybe now I can get access to my account. I forgot my password and tried to jump through their hoops to reaccess my account. They involved calling the support department during business hours. It was the holiday season, so I just gave up.

finchisko 10y ago

The tragicomic part is how they enforcing password complexity: Your password is not strong enough. New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~, or a space So password efZeLmur3ivio4t7 is not safe enough to be used by last.fm and they use md5 without salt to protect it?

lquas 10y ago
This was in 2012. Their password enforcement policies were most likely different back then.
nathanaldensr 10y ago
A password that follows that "security scheme" is pass1!, which KeePass 2 reports as having a quality of 18 bits. efZeLmur3ivio4t7, an illegal password, has a quality of 86 bits. Whoever was responsible for that decision should be fired. Either implement a real password strength algorithm based on entropy, or don't implement any except maybe minimum length.
- finchisko 10y ago
  not just fired, but shot dead :-)

deleted 10y ago

[deleted]

CWuestefeld 10y ago

Question about password best practices. Our site just went through pen testing, as part of auditing for PCI compliance. One thing we got dinged on was that we don't keep a password history, so that the user can't revert to their previous password. The tester's report said, "This, in turn, results in users utilizing a single password for a long period of time, which may result in password disclosure" It seems to me that this is the opposite of the truth. If I'm keeping a password history, then in the event of a breach, there is that much more data that would leaking, potentially disclosing password data if we made a mistake in the rest of how we handle it (hashing, etc.). And while I'm not a crypto expert at all, it seems to me that if there's a list of salted, hashed passwords, then given that the salt is a constant per user, an attacker would have some leg up in discovering the original password if there were many samples that included the same salt. If I want to minimize the data I can disclose about users, I ought to minimize the amount of data that I'm storing about them.

Flenser 10y ago
"given that the salt is a constant per user" Just use a different salt for each password, not each user Edit: You're probably right about everything else.
vidarh 10y ago
Consider that leaking their past passwords only matters if they reuse them elsewhere. If they reuse passwords, then chances are you will expose them just as much if you don't force them to rotate passwords, when they end up putting their password into a scam site or run by people who store plain text. And if you don't check for reuse, you are not forcing them to rotate passwords. In the face of that, you can't do much better than to make it harder for them to keep reusing passwords on your site so at least a password leak elsewhere won't expose their account with you. (And re-using the salt is a mistake; don't do that)
tombert 10y ago
PCI Compliance is kind of arbitrary. I once worked for a company that kept all their passwords in plain text, and still managed to get compliance. I was just an intern at the time, and I still thought that was kind of weird, especially since this was around 2011 and not the mid-90's.

arrty88 10y ago

can someone please make a startup that upgrades unsalted md5 passwords to something better

DeAndre222 10y ago

I know a real professional hacker who has worked for me twice in the past one month. He is very good at hacking anything concerning database, phone, social media and even credit report fixes. He offers legit services. He also helps to retrieve accounts that have been taken by hackers. Contact him at Alphafasttunnel247@cyberservices.com or text him at +1 646 480 9658