12 ms·
Notice of Data Breach
- antonkm 9y agoThis is how transparent an organization should be when breached. Kudos to Under Armour.
- samthecoy 9y agoGDPR, the new EU Data Protection legislation, will actually require companies to issue notification of a breach of PII, within 7 days of becoming aware of it, I believe.
- M2Ys4U 9y agoThat only applies to notification to the data protection authority unless the breach "is likely to result in a high risk to the rights and freedoms of natural persons".
- jacquesm 9y agoThe transparency is nice but it took them almost a month to realize they'd been hacked. That's pretty sloppy.
- tragic 9y ago> The affected data did not include government-issued identifiers, such as Social Security numbers and driver’s license numbers, information that the app does not collect from users Well, I suppose it wouldn't, would it? Is this supposed to be impressive? How many more of these before serious legislation gets through?
- theossuary 9y agoYeah, isn't that impressive, we weren't able to leak what we weren't given/didn't ask for. I wonder if they'll take that as a lesson. Probably not.
- ISL 9y agoThe article is likely to be repeating what was in a press release or statement from the company. It's there to bound above the impact of the breach.
- Jagat 9y ago> It also doesn't include your mother's maiden name, nor does it include your browsing history, email dump, or your camera roll - information that the 'app does not collect from users' /s
- Grollicus 9y agoWell, there are some apps that recorded your call history, even if they had no business knowing that as well. So it propably doesn't hurt to mention?
- matthewmacleod 9y agoThat’s a facile complaint. There are obviously classes of data that are far more sensitive than others; a breach of usernames and hashed passwords, while serious, is arguably distinct from a compromise of more sensitive information. I don’t think there’s anything odd about clarifying that certain data wasn’t compromised.
- zodPod 9y agoI don't think it's supposed to be impressive as much as just reassuring users who are uneducated about that kind of thing. I guarantee someone read this post and started being concerned that it had that information because they don't know how this stuff works. EDIT: Plus, like someone pointed out below, Facebook collected a lot of data that it shouldn't and didn't declare as well.
- sneak 9y agoLegislation? Surely some of these intrusions are from national governments.
- deleted 9y ago[deleted]
- getsugablitz2 9y agoI use my Facebook as the login mechanism for MyFitnessPal, I wonder if that means my Facebook password has been stolen as well. Better change it, sigh...
- JshWright 9y agoMyFitnessPal never had your Facebook password, so there's no way for it to be stolen by a breach.
- electrichead 9y agoThey would have had a long lived token though
- Jagat 9y agoNo, but the auth token might have. Pretty sure facebook would have preemptively invalidated them all, but if not, you should login to your facebook account and unlink MyFitnessPal.
- matthewmacleod 9y agoHow would you even think this would happen?
- getsugablitz2 9y agoMaybe because I don’t typically work with authentication software? I feel like that’s not a hard conclusion to reach, don’t understand the incredulous response...
- internobody 9y agoPerhaps this will also prompt them to start using HTTPS as well?
- Thriptic 9y agoIt's funny you would mention that because I also got annoyed by this and submitted a feature request for https. This is the response I received: Hello, Thanks for writing into us regarding https on MyFitnessPal. We have technical and organizational measures in place to protect your information. Specifically, we have a secure login process designed to protect your information as you access MyFitnessPal (i.e., login and profile data are submitted using HTTPS POST actions). The login pages of the MyFitnessPal that are encrypted via https include: http://www.myfitnesspal.com http://www.myfitnesspal.com http://www.myfitnesspal.com/login http://www.myfitnesspal.com/login http://www.myfitnesspal.com/logout http://www.myfitnesspal.com/logout Although our home page at http://www.myfitnesspal.com http://www.myfitnesspal.com may not indicate the presence of https in your browser's interface, the actual login "lightbox" or pop-over window on the home page does send your login credentials via https. After login, the MyFitnessPal website does not always load in HTTPS only mode (i.e. padlock not fully closed or green). This is because we sometimes load public content like images, public text from Under Armour, images & text from our advertising partners, and other non-user data using HTTP. While we load that public content using HTTP, we load user content using HTTPS. We also continue to evaluate the security of our platforms, and have a dedicated team of cybersecurity professionals focused on this area. We will continue to review our security protocols to protect personal data. Please let us know if you have additional questions or concerns.
- Rick-Butler 9y agotag Troy Hunt and underarmor on Twitter with a pic of this, sit back and enjoy.
- Someone1234 9y agoThat's an extremely embarrassing response. Helps me understand how this data breach occurred if an organization is this uninformed about basic security.
- llccbb 9y agoDoes anyone have a good offline FOSS for macro-nutrient lookup and tracking? Been thinking about starting one for myself.
- Someone1234 9y agoThe biggest limitation seems to be getting the nutrient information itself. MyFitnessPal has a huge database of off the shelf food products built in (and restaurants) from all over the world. Much of that information provided to the company for free by its users. MyFitnessPal has a similar advantage to Google, they have the most and richest data, and anyone else entering that market starts at a huge disadvantage. You could definitely make a FOSS app of the core tracking concept, it is just going to be super painful to use compared to MyFitnessPal.
- rojobuffalo 9y agoYou're absolutely right about datasets being a constraint for any new entrant. The USDA SR28 is free and open but limited scope. OpenFoodFacts has a great dataset overall but ~~you can't download it (other than rate-limited scraping),~~ the license is ~~strict~~ share-alike; and there isn't an OFF personal consumption tracker.
- sl956 9y agoNo need to scrape Open Food Facts, they kindly offer a download of the whole database as csv, rdf or mongodb dump: https://world.openfoodfacts.org/data https://world.openfoodfacts.org/data It is 100% crowd sourced open data under the ODbL licence (same as OpenStreetMap).
- rojobuffalo 9y agoThanks for that correction. I recall there being a clear reason why I couldn't use their data in my app. But maybe I had it wrong. I remember reading that if my app collected new data about foods and I was using the OFF db, I had to commit to making all my data free and open. I was worried about the possible case that personal food consumption data would be vulnerable to that share-alike constraint.
- jnsaff2 9y agoNo info either way about whether peoples very personal fitness data was breached, eating habits, weight, other measurements. Appaling PR speak.
- AznHisoka 9y agoI hope the log of my sex activity resulting in losing 20 lbs wasn't breached!
- jnsaff2 9y agowell played ... or is it? Freddy Mercury anyone?
- jnsaff2 9y agoThe other comment was flagged but the point I was trying to make is that these two data points of lots of sex and radical weight loss can be interpreted as being promiscuous and getting HIV. Or obviously as a success and success. Which is just why breach of this data is dangerous.
- corobo 9y agoOfficial release https://content.myfitnesspal.com/security-information/notice.html https://content.myfitnesspal.com/security-information/notice...
- sctb 9y agoThanks, we've updated the link from http://www.baltimoresun.com/business/under-armour-blog/bs-bz-under-armour-myfitnesspal-breach-20180329-story.html http://www.baltimoresun.com/business/under-armour-blog/bs-bz....
- colemannugent 9y agoMods, there's a better article on Reuters: https://www.reuters.com/article/us-under-armour-databreach/under-armour-discloses-breach-of-150-million-myfitnesspal-user-accounts-idUSKBN1H532W https://www.reuters.com/article/us-under-armour-databreach/u...
- gaius 9y agoBetter in what way? This is notable because it is the official word of the company, so we can discuss how forthcoming they are.
- deleted 9y ago[deleted]
- iamben 9y agoNo notification via email or app for me as of yet... Seems like the sort of thing I should hear from them first, rather than the Baltimore Sun.
- rconti 9y agoDitto. When I logged into the web page to change my password (which I never use.. dear god, it's ugly, too), I got a warning. But nothing in the app.
- geerlingguy 9y agoI got an email an hour ago, but I signed up fairly recently. Maybe emails are in batch, reverse order.
- fastball 9y agoI got an email at 9:54 EST (half an hour ago), and I've been a user for years now. So it's not exactly the most prompt email I've ever received.
- bhouston 9y agoMyFitnessPal was horribly written app when I used it. The idea was good but God was it slow as hell when doing simple things.
- rconti 9y agoIt mostly works pretty well and looks okay, though the add actions have inexplicable lag on an iPhone X. The web page is horrendous, though. Overall, the execution is good. I love the integration with iOS activity which means all my Strava and watch+activity and Wahoo cycling computer activities are tracked/integrated. I thought it would be a massive PITA and avoided tracking for years and years because of this, but I'm at something like 120 days straight and it's been a breeze.
- lev99 9y agoI started using the app in 2012. I still use it. I'm under the impression it's the best nutrition tracking app. I've moved on to iHealth for tracking weight and exercise amounts, which I used MyFitnessPal in the past. This information is still in MyFitnessPal, and I will sometimes look at the graphs there, but not often. Apple Watch and a Bluetooth scale are great for the quantified self.
- rojobuffalo 9y agoI didn't think MyFitnessPal was good enough either so I started working on a chatbot that you can just tell it what you ate in natural language and it will maintain a private web journal for you. I got a basic version to work and then discovered [Nutritionix][1] and lost motivation to compete. They seem to have nailed to web UI part. And they have an NLP input form you can use in the app. So it isn't the same as just texting a bot since you have to open the app, but the NLP is pretty good. And the UI for verifying what the NLP comes up with is also good. After researching every app I could find in this space Nutrionix stands as my favorite. [1]: https://www.nutritionix.com/app https://www.nutritionix.com/app
- OldSchoolJohnny 9y agoMFP is extremely limited when it comes to tracking micronutrients. If all you care about are very basic facts it's alright. If you care about much more then Cronometer is commonly considered the best.
- BadassFractal 9y agoI wonder if the daily progress photos were leaked as well. I imagine most people won't be thrilled to have their not-too-flattering progress selfies be out in public for the whole world to see. Side note: MyFitnessPal the app is awful, but many of us still use it because it has the most extensive database of food products out there. Outside of that it has no merit and has felt abandoned in forever. Can someone recommend an actually superior alternative?
- matthewmacleod 9y agoWhat’s wrong with it, out of interest? It seems to work perfectly reliably for me, and I’m super happy that they aren’t getting all change-happy with it.
- bcongdon 9y agoThe iOS app has been pretty good (if a bit buggy and slow), but the desktop web interface is so bad to the point that I haven't used it in over a year -- and I use myfitnesspal daily.
- matthewmacleod 9y agoFair, I also haven’t. I imagine barely anybody does.
- BadassFractal 9y agoI've definitely had the app perma-crash on me recently, where the only way to get out of the boot-then-crash loop was to delete and reinstall it. It also fails at the iOS quick access menu about 80% of the time. e.g. you hard-press the app icon, go to "log food" and it goes back to the home page. Or you do the same for "scan barcode" and again most of the time it opens the app and sends you to the home page again. This has been the case for months.
- Distant_horizon 9y agoAlternative: Cronometer's database is almost always more accurate. https://cronometer.com/ https://cronometer.com/
- djflutt3rshy 9y agoAnnouncing it after markets close and right before a long weekend (markets are closed on Good Friday). Classy.
- Someone1234 9y agoThat's unfortunate. At least we didn't get the stereotypical "your passwords are hashed, so nothing to worry about" one liner I've been reading from a lot of companies during disclosures. All they said here is that the passwords are hashed and with a reasonably secure method -- bcrypt (although without knowing work-factor and percentage of passwords, it is hard to know just how strongly). It has become pretty difficult to operate online these days without password managers. Password reuse has become a massive problem that worsens with each breach at a popular service. With a password manager you can just rotate the randomly generated password since you likely didn't know your old one anyway. Off Topic: I'm surprised nobody makes a hardware "pepper"[0] that supports popular algorithms. Meaning you hash the password as you normally would (inc. salt) and then send it through the pepper-ing device for another round before storing it. That way even if someone stole the database, knew the salt, and the hashing algorithm+work-factor, they'd still lack the hardware pepper making their job significantly harder. [0] https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography)
- Someone 9y ago”All they said here is that the passwords are hashed and with a reasonably secure method -- bcrypt” The “majority” of the passwords was hashed with bcrypt. https://content.myfitnesspal.com/security-information/FAQ.html https://content.myfitnesspal.com/security-information/FAQ.ht...: ”The MyFitnessPal account information that was not protected using bcrypt was protected with SHA-1, a 160-bit hashing function.” That majority could be as low as 50.0000001%. I also couldn’t find how many accounts were affected. I guess they don’t know, so we must assume all of them.
- recursive 9y ago> That majority could be as low as 50.0000001% It could only be that low if they have about half a billion user accounts.
- matthewmacleod 9y agoThey probably do know, and practically speaking I would guess that those accounts using an older hash are those which nobody has logged into since they switched to bcrypt. Yeah, we don’t know for certain, but it’s a reasonable assumption.
- deleted 9y ago[deleted]
- mvpu 9y ago"On March 25, 2018, we became aware that during February of this year an unauthorized party acquired data associated with MyFitnessPal user accounts" => highly likely they stole more than what MFP thinks they stole.. we don't know what we don't know. Sigh.
- komali2 9y agoSomebody is about to come across 250 pictures of me in my boxers standing in front of a dirty mirror with my belly popping out. I only hope they don't judge me for the size of my belly not really changing over those 250 days...
- asadjb 9y agoThat was my first thought as well. But as per the article, only usernames, emails, and hashed passwords were taken.
- lazyasciiart 9y agoIt doesn't say 'only' - it implies by omission that your content was not part of the breached data, but does not assert it. It says the data breach 'includes' usernames, emails and passwords.
- borne0 9y agoHi, even if a data breach hadn't happened, did you have any concerns about people within the company having access to those photos? I also use myfitnesspal and strava but I have a strong aversion to sharing that kind of info with anyone, period. I'm 36, is this a generational thing?
- craftkiller 9y agoI'm 9 years your junior and I wouldn't care if pictures of me fully naked were all over the internet, but at the same time I'm a privacy freak. I think the division for me is: my image says nothing about me other than my love of gluttony, but my words and actions are my identity.
- jlarocco 9y agoI guess it's a philosophical issue, but I would consider my physical image to be a part of my identity. In a way it's a reflection of a person's actions.
- 9y ago
- loeg 9y agoAh, I had an account here. Checked Lastpass, and, great! They've got my six character don't-care-about-MyFitnessPal-security password. bcrypt will not save its secrecy in any way, but it hardly matters.
- deleted 9y ago[deleted]
- graystevens 9y agoWould be interesting to know how they identified the breach. It is exactly these situations that I produced Breach Insider[0], in the hope to try and reduce the time to detection down from months to days. Those of you affected by this breach, have you noticed any unusual spam/emails recently, that may be related to MFP? I’m wondering if they got the tip-off from their users. [0] https://breachinsider.com https://breachinsider.com
- urlgrey 9y agoThe breach notice indicates that hashed passwords were compromised but doesn't mention whether a salt was used when computing the hashes. Use of a salt makes all the difference, guarding against the use of rainbow tables to look up precomputed hashes of common passwords.
- mfonda 9y ago> The affected information included usernames, email addresses, and hashed passwords - the majority with the hashing function called bcrypt used to secure passwords. If they're using bcrypt, then they're using salts since salts are built in to bcrypt.
- aviv 9y agoPeople are so numb to these data breaches, companies will soon report such breaches just for the free press they get.
- lanius 9y agoAny free MyFitnessPal alternatives with an open API for retrieving diet/exercise activity?
- Distant_horizon 9y agoCheck out Lifesum https://lifesum.com/ https://lifesum.com/
- propman 9y agoShould be a fine every time this happens and a major fine if it was found due to negligence or not having the appropriate security measures aka yahoo. Yahoo leadership new they were understaffed, cut staffing anyways, got rid of any executive who disagreed, and got no penalty for their mistakes. Make it more costly to get fined than it is to get hacked. Or some white collar jail time if it wss negligence or covering it up.
- jacquesm 9y agoThe GDPR will cover that. And those fines are massive. It's not going to be a magic bullet against breaches but the effect will definitely be that companies will start to see security no longer as optional or an afterthought but a direct liability if not taken care of properly.
- PuffinBlue 9y agoSigned up to MFP yesterday to test it out. Immediately noticed they don't use https (though the login forms appear to be submitted over https). I thought to myself - on the face of it they don't seem to hot on security, I wonder how long it will be before they get hacked or something? Well, I wasn't expecting less than 24 hours.
- matt_wulfeck 9y ago> The affected information included usernames, email addresses, and hashed passwords - the majority with the hashing function called bcrypt used to secure passwords. I really appreciate them including this information. It shows they’re following best practices and I don’t need to read the rest of the article with a grain of salt.
- aaronharnly 9y agoExcept when you get to the part about “the rest of the passwords were hashed with SHA1”...
- arcbyte 9y agoShould we actually care? I really didn't care even when my OPM info got hacked. Just make this shit public and stop believing in secrets.
- scottmf 9y agoZuck?
- masslessness 9y agoImagine this happening in any other industry. "Oh hi users, the things you gave to us and we were supposed to keep safe, well, someone came and took them." Say the bank sent all their customers a similar message, how would their customers be expected to react? Why is it any different in the tech industry? Basically these apology messages amount to: "Someone accessed your private stuff, please change the special key you use to access your stuff. End." Should there be more to this than just that? Yes you'll make sure the locks are stronger, but what about that thing I've now lost? What are you going to do about that?
- __david__ 9y ago> Imagine this happening in any other industry. You mean like when Home Depot lost thousands of credit card numbers? Or when Target did the same? Or when Equifax lost millions of people's private data? The response is always "Welp, sorry! We'll do better next time!" and the tech industry isn't alone here.
- oculusthrift 9y agohm anyone know if they are salted as well?
- Dzidas 9y agoI wonder, can I get a dump of the data collected on me based on the European Law? Similar, that Facebook provides to everyone.
- icebraining 9y agoPresumably yes. The site of the guy who sued FB has a template you might be able to reuse[1], although it mentions the Irish implementation of the Data Protection directive, whereas Under Armour Europe B.V. is Dutch, so you should probably change that. [1] http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data_.html http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...
- daniel_iversen 9y agoProps for them doing the right thing and hopefully nothing bad comes out of it - looks like they’ve built a useful product. One thing that’s odd to me on many levels though is that it was their Chief Digital Officer signing the announcement and not their head of security. Don’t they have one? Wasn’t this severe enough? I know it’s just perception but still!
- dvcrn 9y agoTried to change my password just now but can't. Clicking on 'change password' logs me out again, anyone else?
- JimDabell 9y agoThe MyFitnessPal database has been compromised for years. I register with a unique email address for every website and app that I use so that I can tell when somebody's database gets compromised or they sell my data. I started getting an influx of spam to my MyFitnessPal email years ago. I told them about it at the time but they didn't care.
- plopilop 9y agoMaybe they just sold your email, they don't need to have been breached for that.
- JimDabell 9y agoAs I mentioned in a Reddit thread [0]: I never agree to sharing my email address with partners, so if that's the case, then it was without my consent. However generally speaking, I've noticed there's a big difference in the spam you get from somebody selling your data and the spam you get from a database compromise. When somebody sells your data, you get spam from real organisations who happen to be acting in a sleazy way (e.g. bulk promo emails sent to people without their consent). When somebody's database gets compromised, you get things like phishing emails and V14gr4-style emails designed to bypass spam filters. The MyFitnessPal spam was the latter sort. Here's an example: ****Quailty Medstore 2017**** --Low Pr1ce$ For Pills-- --Fsat Delivery Wroldwide-- --Trusetd Onlline Shhop-- <spam URL redacted> This was sent to an email address I've only ever given to MyFitnessPal. MyFitnessPal say the breach happened in late February of this year, but this email was sent in August of last year. [0] https://www.reddit.com/r/unitedkingdom/comments/888ds3/under_armour_data_breach_affects_150_million/ https://www.reddit.com/r/unitedkingdom/comments/888ds3/under...
- sorokod 9y agoHowever generally speaking, I've noticed there's a big difference in the spam you get from somebody selling your data and the spam you get from a database compromise Even if this is true, the sold data may be compromised further down the line.
- konceptz 9y agoThe next thing people will check may be insider trading: https://www.nasdaq.com/symbol/ua/insider-trades https://www.nasdaq.com/symbol/ua/insider-trades Can anyone more versed in this do a quick look for abnormal behavior?
- tomcooks 9y agoI assume it's a bigger problem for females, because of the different way society perceives female or male sexuality. E.g. I don't think i would really care about pics of my dick being made public, but plenty of women get routinely harrassed (often to the point of sexual assault or suicide) because of sexy selfies some idiot shared with friends.
- greggarious 9y agoThis breach notification is very mealy mouthed. >The affected information included usernames, email addresses, and hashed passwords It included usernames, emails, and hashed passwords? So what else was breached? This seems like they are implying nothing serious was stolen without giving specific info.
- borplk 9y agoI'm 99% certain it included everything. From what I have seen very very few companies have strictly separated databases for different types of data and so on. For the vast majority of companies a compromise is an all or nothing event.
- mfp001 9y agoI received notification via email of the MyFitnessPal breach. I do not use MyFitnessPal or any other related product. Should I be concerned.
- mfp001 9y agoI received an email notification of the MyFitnessPal breach. I don't use that package or any other related products or service. Should I be concerned.