10 ms·
Disqus Security Alert: User Info Breach
- cristoperb 9y agoI just learned about this thanks to an email from https://haveibeenpwned.com/ https://haveibeenpwned.com/ alerting me that my account info was leaked.
- deleted 9y ago[deleted]
- katastic 9y agoI just got one about Kickstarter. I've had like 8 this year affect me. Scumbags. If you look at haveibeenpwned's twitter it's like EVERY DAY almost that some major site has a breach. And it's all going on while Congress is too retarded to notice. [edit] Oh, and that "Ding" on my phone was this one too. Lovely. Just lovely. I've literally started switching every infected one, with a custom password generated by SHA-512 fed with /dev/random, and they're 64 characters long except when the POS website refuses to allow that many characters. Even worse, all the "health insurance" and other big-whig companies? Do insane stuff like require "8-16 characters. alphanumeric and capitals only." or even more insane "alphanumeric lower case only." It's impossible in 2017 to actually use modern websites... and be secure. Even if they kept their stuff safe (which they don't), you can't even use a secure password because they won't let you. You're stuck using a couple of actually secure website services like Google and (maybe?) Facebook. But what about the hundreds of other sites you have to interact with every year? Many of which don't support a secure 3rd-party authentication? If my small IT company treated our client's security the way health insurance companies do, we'd be out of business... and possibly in jail. [edit] Who the hell downvotes this? Explain yourself.
- marak830 9y agoBig thank you to Troy Hunt for this service, I just got my email too. I read your comment just after you posted it and thought, "oh I haven't gotten an email yet, I must be safe". . 50 minutes later it came through :-p
- cisanti 9y agoAnd I learned it from your comment. Just tried haveibeen and confirmed disqus leak. No emails from disqus!
- kakkun 9y agoI got an email too. The thing is, I don't have a Disqus account. The only mention of Disqus in my gmail account is the haveibeenpwned email. Any idea what's going on?
- simoncoggins 9y agoSame happened to me. I think I may have used the social media login via Google, which I'm guessing could get your email into the leak without any password being present.
- toyg 9y agoI had three emails from HIBP today, for 3 different breaches: Disqus, Kickstarter and Bitly. Three, in a day. These breaches are all years old and at least one of them was set to one of my old passwords I reused in a lot of places (before moving to a pwd manager), so it could have done some real damage. The fact that it didn't happen, makes me think that salted hashing did what it was supposed to do, discouraging bruteforce decryption just enough. Still, the state of the industry is pretty shocking. We are doing more and more stuff (super-encryption at rest, constant password rotation, password managers etc) and still breaches happen with regularity. It feels a bit like when Office started having a system to recover documents after a crash - yeah, great, but why is the crash happening so often that we need it in the first place?
- pussypusspuss 9y agoSHA1 hash? You’ve gotta be fucking kidding
- sergiotapia 9y agoIt's from a database from 2012. Wasn't that cutting edge in 2012? What kind of sick shit will we be encoding our stuff 6 years from now, that bcrypt will seem laughably ill-suited.
- meditationapp 9y agoSHA-1 has been known to be vulnerable since 2005, and even in 2012 SHA-2 and SHA-3 were recommended. Nonetheless, you have a point!
- gruez 9y ago>SHA-1 has been known to be vulnerable since 2005, and even in 2012 SHA-2 and SHA-3 were recommended. FYI, the requirements for a password hash function is significantly different than for a cryptographic hash function. the vulnerabilities you're talking about doesn't affect any of those properties. password hashes only need to have preimage resistance, and (more importantly) be slow as to limit offline attacks.
- tptacek 9y agoThis is pretty much correct. It doesn't much matter what cryptographic hash you use to store secrets, and all of the general-purpose cryptographic hashes are bad password hashes. Salted SHA-3 would not be materially better than salted SHA-2 here.
- tylersmith 9y agoIt was not at all cutting edge. In 2012 I helped a number of companies move from bcrypt to scrypt.
- 9y ago
- electic 9y agoThis is a good time to remind everyone to use a password manager and to have each password generated. Each service should have it's own password so if it gets compromised, your exposure is limited to that one service. It is clear this is going to be a staple of internet life, so might as well be prepared.
- thekashifmalik 9y agoThis.
- deleted 9y ago[deleted]
- jv22222 9y agoAgain, HN, please explain to me why “This.” was downvoted here. Why is it wrong for somome to acknowledge and undersore what somone else says? It’s the kind of thing that happens in real world conversation and we don’t rebuke people for agreeing and underscoring what somone else says in that context so why do it here? I’m genuinely curious.
- LeoPanthera 9y agoIt adds nothing and wastes space. If you agree, just upvote.
- imron 9y agoThis.
- fossuser 9y agoAt the risk of increasing an unnecessary thread, the parent comment adds nothing to the discussion and the upvote exists for this purpose.
- deleted 9y ago[deleted]
- avishai2112 9y agoHow can an independent security researcher be aware of such a breach ?
- deleted 9y ago[deleted]
- sillysaurus3 9y agoIt's possible the researcher managed to get into a position to download the same database snapshot.
- blakesterz 9y agoCheck out his YouTube channel, he explains things quite often: https://www.youtube.com/channel/UCD6MWz4A61JaeGrvyoYl-rQ https://www.youtube.com/channel/UCD6MWz4A61JaeGrvyoYl-rQ And many blog posts explains what how he does it: https://www.troyhunt.com/ https://www.troyhunt.com/ Pretty sure this is the one he mentioned in his video today as having been given to him by someone else.
- cisanti 9y agoThey have contacts and ears in the underworld I suppose :=)
- jlgaddis 9y agoOne guy in particular, I can't recall his name (Chris Vickery, maybe?), has been behind A LOT of these "discoveries"; specifically, a bunch of Amazon S3 buckets that are misconfigured (WRT permissions) and wide open to anyone who wants to download the data. (I'll admit that I'm kinda curious as to how he enumerates all of them!) Based on the little information published, it sounds like that's what has happened in this case as well. The same guy has also found tons of wide open MongoDB instances and such. The guy you're referring to, Troy Hunt (HIBP) , writes about these cases but, AIUI, doesn't typically find them on his own. He's usually notified by the actual "researcher" -- this Chris guy in a lot of recent cases -- and they share the info with him.
- graystevens 9y ago
- stevenj 9y agoThe rate at which these security breaches are happening is very alarming to me. I don't know what the effects are of them (including this one), but my gut tells me they'll only increase over time; perhaps the severity of them as well. It's honestly making me re-consider my use of the internet, technology, and electronics. What's the future hold with regard to security, breaches, and keeping our data and information safe?
- strooper 9y agoFrom the philosophical point of view, we cannot avoid these security breaches in the digital world. We need to leap forward to analog or quantum computing to leak proof our information. I wonder if there will be any information private by then.
- tylersmith 9y agoFor a long time people didn't care because they thought it couldn't happen or wouldn't affect them but I'm optimistic that people are learning, albeit slowly.
- monksy 9y ago> The rate at which these security breaches are happening is very alarming to me. This should be no surprise if you're a developer. "Lean/'agile' companies" have tried to cut cost so agressively that we don't have QA teams, tickets have to go as fast as possible, etc. Businesses won't care about this until it hurts their bottom line. Even then they'll deny that it's possible.
- jacquesm 9y ago> The rate at which these security breaches are happening is very alarming to me. It is the rate at which they are being published that is alarming to you, the rate at which they are actually happening is much higher still.
- tptacek 9y agoRight now there isn’t any evidence of unauthorized logins occurring in relation to this. No plain text passwords were exposed, but it is possible for this data to be decrypted (even if unlikely) Where by "unlikely" we mean "with almost complete certainty".
- jlgaddis 9y agoThat was my first thought upon reading that. Someone at Disqus should take those lists of hundreds of millions of hacked passwords, hash 'em with SHA1, and see how many aren't in their own list.
- deleted 9y ago[deleted]
- bradknowles 9y agoYou mean, like Troy Hunt, of “haveibeenpwned” fame?
- slvrspoon 9y agoIt's not just your passwords of course but also email and sometimes phone and credit cards you have potentially stored at sites as well.
- kylehotchkiss 9y agoAll these leaks are making me feel anxious to go around deleting anything I no longer use and be more careful about signing up for anything without FB/Google login. It seems like only giant companies have the competence to maintain security BUT even then, Yahoo proves me wrong on that one. That said, I'm sort of happy 1password switched to subscription billing - hopefully this lets them pay top dollar for the best security experts.
- Ibethewalrus 9y agoSomeone posted on HN fastmail includes a very unusual and nice way to stop spam using alias, basically it's mailinator baked in: https://www.fastmail.com/help/receive/aliases.html https://www.fastmail.com/help/receive/aliases.html
- carrier_lost 9y agoOutlook.com offers aliases too: https://support.office.com/en-us/article/Add-or-remove-an-email-alias-in-Outlook-com-459b1989-356d-40fa-a689-8f285b13f1f2 https://support.office.com/en-us/article/Add-or-remove-an-em...
- rhblake 9y agoI don't think Outlook.com supports catchall/wildcard aliases though, which makes using unique addresses for everything a bit annoying, which makes address reuse more likely.
- carrier_lost 9y agoInteresting point! I hadn’t thought about wildcards in aliases.
- nathanaldensr 9y agoI pay for FastMail for this very reason. When I transferred off my Google Apps email account, I set up a unique ___@ for every website. If my email ever leaks, I'll know who leaked it (or sold it).
- subcosmos 9y agoSHA1..... That's bad Current gpus can hash tens of millions of passwords per second with SHA-1.
- Ajedi32 9y agoSome back of the envelope calculations... [A GTX 1080 can do ~8.5 billion hashes/second][1]. An 8-character, truly random password with mixed case, numbers, and symbols has (26 * 2+10+32)^8 possible combinations. That means an attacker with a single GTX 1080 could crack such a password ((26 * 2+10+32)^8/2) / (8538.1 * 10^6)) seconds ([approximately 4 days][2]) on average. And most user's passwords are most certainly not truly random (i.e. they're significantly weaker than that). [1]: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... [2]: https://www.wolframalpha.com/input/?i=((26*2%2B10%2B32)%5E8%2F2)+%2F+(8538.1+*+10%5E6))+seconds https://www.wolframalpha.com/input/?i=((26*2%2B10%2B32)%5E8%...
- deleted 9y ago[deleted]
- jedisct1 9y agoFor the record, Bcrypt exists since 1999.
- jlgaddis 9y agoSounds like somebody left an S3 bucket wide open yet again.
- foxhop 9y agoWas the salt leaked?
- nathanaldensr 9y agoAnother important question: Did they use a unique salt per password? Their announcement is ambiguous.
- Ajedi32 9y agoThat's the general idea of a salt, yes. I'd argue that a salt which isn't unique per-user isn't really a salt at all.
- throw2016 9y agoWe just have to concede centralization is a dark pattern online. Its creates incentives for obsessive profiling, surveillance and makes a complete mockery of privacy. In many ways the old world of dispersed forums were much better and are still better content wise than anything Reddit can throw up. You can share photos and remain connected to family and friends without needing anything like facebook. This kind of centralization only favours self promoters and exhibitionists and shifts tremendous personal data patterns to entities who have no business having or analyzing this data. No one should have access to this kind of data as the consequences can only be negative.
- bobwaycott 9y agoIs the info available online somewhere? I’m curious what my password was in 2012.
- cyberferret 9y agoI am always puzzled when a company reports a breach and says "X account details were compromised, and Y passwords were obtained..." when Y is a smaller percentage of X. I would assume that there is always a 1 to 1 relationship of user account details to passwords, or that the passwords are stored within the user table in the DB, so at best, X=Y at all times? I can understand if it is a current breach and the DBAs managed to stop a transfer of data mid query, but in a 4 year old database (in this case) where only hackers only have partial data for passwords, but full data for user accounts?
- Ajedi32 9y agoDisqus provides options for single-sign-on. So it's possible that some of the accounts breached didn't have a password associated with them, only OAuth tokens.
- syshum 9y agoThis highlights an important aspect of Data Security that is often never talked about Data Minimization. It seems they had a old copy of the database, likely a backup, just sitting around somewhere. The question is why did this old copy, from 4 years ago, still exist. Why was it not deleted under a standard data retention policy. Companies not only need to spend time on how they will secure data, they need to spend time on how they will age out and delete old data.
- CaptSpify 9y agoWe really need to get companies to see user data as a liability, rather than an asset. Our incentivisation system is completely backwards for this.