4 ms·

> As executives reflect on LivingSocial’s fatal moment, all point to a security breach in April 2013. Hackers gained access to the account information of 50 mil

by swang 10y ago

> As executives reflect on LivingSocial’s fatal moment, all point to a security breach in April 2013. Hackers gained access to the account information of 50 million subscribers, and LivingSocial forced all of them to reset their passwords. About 20 percent never came back. I don't know how they came to this number, but at least it's something to point to when the c-level executives decide password security is something that they can just skip doing. Obviously part of that 20% is are just dead accounts but still, something to show next time you're in this situation.

HalfwayToDice 10y ago
80% of total members continued to use the website after the password reset? That seems too high. Perhaps they meant 80% of active members. Unless the website had an incredibly low churn rate.
protocow 10y ago
Or c-level executives will remember this tidbit before they let their security folks talk them into a password reset after a breach. You have to wonder whether a company in that situation has other options, like blocking logins from previously unseen IPs (for users who don't change passwords).
- hackerboos 10y ago
  You think a company that was using SHA1 [0] to hash passwords was actually logging IP addresses? [0] - https://arstechnica.com/security/2013/04/why-livingsocials-50-million-password-breach-is-graver-than-you-may-think/ https://arstechnica.com/security/2013/04/why-livingsocials-5...
draw_down 10y ago
Hmm, isn't that the opposite of a good example? Here's what I feel like a C-level exec would take away from that story: if you ask users to reset their password, you'll lose 20% of them.
- swang 10y ago
  my viewpoint was once there is a breach there will be anger and maybe 20% of our customers don't come back. not resetting passwords and possibly further endangering your customer base seems like a bad idea. but i can see someone taking your viewpoint... which is worrying.

by swang 10y ago

HalfwayToDice 10y ago

80% of total members continued to use the website after the password reset? That seems too high. Perhaps they meant 80% of active members. Unless the website had an incredibly low churn rate.

protocow 10y ago

Or c-level executives will remember this tidbit before they let their security folks talk them into a password reset after a breach. You have to wonder whether a company in that situation has other options, like blocking logins from previously unseen IPs (for users who don't change passwords).

hackerboos 10y ago
You think a company that was using SHA1 [0] to hash passwords was actually logging IP addresses? [0] - https://arstechnica.com/security/2013/04/why-livingsocials-50-million-password-breach-is-graver-than-you-may-think/ https://arstechnica.com/security/2013/04/why-livingsocials-5...

draw_down 10y ago

Hmm, isn't that the opposite of a good example? Here's what I feel like a C-level exec would take away from that story: if you ask users to reset their password, you'll lose 20% of them.

swang 10y ago
my viewpoint was once there is a breach there will be anger and maybe 20% of our customers don't come back. not resetting passwords and possibly further endangering your customer base seems like a bad idea. but i can see someone taking your viewpoint... which is worrying.