11 ms·
At Blind, a security lapse revealed private complaints from tech employees
- saagarjha 8y ago> The database also contained passwords, which were stored as an MD5 hash !!!
- eat_veggies 8y ago> Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.” !!!!!!
- 908087 8y agoDon't worry, they also double ROT13 everything.
- spydum 8y agoWhile SSHA2 isnt that bad if they’ve applied a work factor, but that’s probably not the case.
- shawn 8y agoIt's probably better to list what the real solution is: Bcrypt or scrypt. https://www.npmjs.com/package/bcrypt https://www.npmjs.com/package/bcrypt I also added it to a fork of Arc that I'm managing. https://github.com/shawwn/arc3.2/tree/ln/src/bcrypt https://github.com/shawwn/arc3.2/tree/ln/src/bcrypt (Just type `make` and then run Arc like usual. Which is `racket -f as.scm`.) Thanks to Scott Bell for providing code examples of how to use the racket FFI interface and unix crypt function, and for glancing over the finished code. That leaves the question of what an appropriate bcrypt work factor is. 10 is apparently about right.
- tprynn 8y agoIt doesn't matter what algorithm you use to hash passwords when users login if you also store them md5-ed somewhere else!
- wyldfire 8y agoTsk, but this was an upgrade from the old log that stored the first three letters of the passphrase. ;)
- deleted 8y ago[deleted]
- farazzz 8y agoIsn’t SHA2 the standard hashing algorithm? If not, what do people use now?
- Thriptic 8y agobcrypt is one example: https://auth0.com/blog/hashing-in-action-understanding-bcrypt/ https://auth0.com/blog/hashing-in-action-understanding-bcryp...
- hamandcheese 8y agoFor password hashing, you want the operation to be slow. That way it becomes infeasable for someone to brute force many passwords. SHA2 is very fast.
- deathanatos 8y agoIf I get any of this wrong, I claim Cunningham's Law. :) From the "Cryptographic Right Answers" [https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html#password-handling https://latacora.micro.blog/2018/04/03/cryptographic-right-a...]: > Latacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2. > Avoid: SHA-3, naked SHA-2, SHA-1, MD5. SHA2 is a decent cryptographic hashing algorithm, that is true. But a cryptographic hashing algorithm isn't what you want when storing passwords, at least, not on its own. Some of the problems with just using a hash algorithm: same passwords have the same hash; hash algos are typically fast, so brute forcing can make many attempts quickly, and they can be pre-computed into rainbow tables. There are ways to fix this (salts, work factors), but generally you shouldn't "do it yourself."; functions like those named in the quote from Cryptographic Right Answers put all that together in a nice package. scrypt, I believe, even uses SHA-2 in its construction, but also solves the aforementioned problems. The "Purpose and operation" part of the Wikipedia article for PBKDF2 (also mentioned above) goes into some of this, as well (even if it is only recommended as a last resort, I think this paragraph is educational w.r.t. the problems around passwords): https://en.wikipedia.org/wiki/PBKDF2#Purpose_and_operation https://en.wikipedia.org/wiki/PBKDF2#Purpose_and_operation
- shawn 8y agoSHA2 is fine for guaranteeing integrity. But that's different from coming up with a way to store a password that can't be brute forced in a small amount of time. The goal is to make the hashing function expensive. That is a different goal than making it reliable or authentic.
- sjroot 8y agoHow incredibly convenient for an anonymous social networking dedicated to complaining about your employer. </conspiracy>
- tatar 8y agoI keep saying this as well, it's not an anonymous forum. It's an HR tool. You sign up with your company email ffs.
- remote_phone 8y agoI’m glad to hear at least they don’t seem to be storing ip addresses.
- xivzgrev 8y agoSounds like they don’t give a shit and only reacted when TC was going to write a story about it. Surprising given that user trust is at the core of their business, and without it they have nothing.
- foobiekr 8y agoTheir inaction on being notified is quite damning.
- whatshisface 8y agoIf I was an evil CEO, I would purposely start an anonymous messaging platform just to collect compromising statements.
- mrep 8y agoLol. I like the concept of blind but it is one of shittiest apps I have used. Their app consistently doesn't respond correctly to buttons and their redesigns just make their user interface worse. Oh, and on the topic of security, one guy found a SQL injection exploit and demonstrated it by giving any users who commented on their post 100 likes...
- xiphias2 8y agoThey made a big mistake, but generally I love reading Blind. There are a lot of interesting things on it about which I couldn't talk even to my own colleagues.
- ggggtez 8y agoAs many others, I had heard about it and never actually took a look until now. Seems like a waste of time to me. Make a throw away account on Reddit like everyone else, and you'll probably get more well thought out and measured replies.
- xiphias2 8y agoOn Reddit I have no idea where a person who replies really works. You either haven't found the interesting threads or the interesting replies from internal people that make Blind different.
- ggggtez 8y agoObviously your mind is made up, but I don't think you've considered that you don't really know that someone is a VP at X company on Blind, either. They could be a janitor. People are welcome to enjoy whatever fiction they want to read. I'm just saying you'll probably find more useful and reliable information elsewhere.
- duxup 8y ago>At its core, the app and anonymous social network allows users to sign up using their corporate email address, which is said to be linked only to Blind’s member ID. People just trusted it? I get that to seem legitimate the users have to be confirmed in some way, but as a user... now way am I exposing myself that way.
- nradov 8y ago”I have over 4,000 emails, pictures, addresses, SNS ... People just submitted it. I don't know why. They 'trust me' Dumb f*s." -Mark Zuckerberg, 2004 The more things change, the more they stay the same.
- zlast 8y agoThe emails were "sitting plaintext in an exposed database." Major things wrong: unencrypted email addresses + private messages, leaving the database without a password, database wasn't fixed until a week after knowing of the error. I find it concerning that this kind of news seems normal now.
- duxup 8y agoThe scale of poor security by default these days is pretty horrifying.
- Nasrudith 8y agoI would go further and say using it is gross incompetence along the lines of a broker taking stock investment advice from spam email. Literally the only reason why someone would send out random stock advice like that is doing a pump and dump scheme. Similarly if they aren't going to use your email then they have no reason to ask for it and any 'anonymous' app that asks for identifying information isn't.
- aryamaan 8y agoI get the sentiment you are sharing and I am not advocating execution of Blind anyway, but it you want to make anonymous "rooms" like say peole from Google belong to one room and Facebook to another. How'd you make that without first establishing that someone is from Google. I understand taking their work email is asking for more info than desired. Probably they can use something zero-knowledge (I am not well aware of the concept) where someone proves their employer's identity without their own.
- northerdome 8y agoAnyone who believes a random startup that advertises they provide anonymity in security on their homepage is smoking something strong. No legitimate company that cares about security makes such absolute statements.
- ineedasername 8y agoI'd never checked out Blind before. I just went there and checked out a few of the front page posts & comments. It has some of the most toxic and destructive "advice" I've seen for people asking for help or insight. I'm a bit astounded. Is this typical?
- mrep 8y agoExamples?
- skrebbel 8y agoEverything on https://www.teamblind.com https://www.teamblind.com
- khyryk 8y agoFirst time taking a look at that site and I'm pretty sure a lot of it is trolling. Lots of threads starting with something semi-ridiculous or controversial to solicit lots of responses to which the OP spends an unreasonable amount of time responding to. Classic flame baiting.
- SolaceQuantum 8y agoMy first look at Blind rated cities to work in by how hot/available women were there (e.g. comments like "SF sucks, you have to settle on dating uglies" or "NYC women are so much hotter than SV women, no contest where to live"). The question asked to the Blind community was just "where would it be better to live long term" or something completely not to do with dating or women, but the majority of responses were about the hotness of women dates. Later on, I found unsavory relationship advisement going on, and further than that, outright racism against Indians in particular. None of these comments were downvoted, many encouraged and agreed upon. (EDIT: Not downvoted, criticized, sorry.(
- vonmoltke 8y ago> None of these comments were downvoted Blind doesn't have downvotes (which could be part of the problem there).
- bg24 8y agoI have used blind. Some posts were pretty blatant. Just like Madison-Ashley, someone is going to dump all those posts in future. And somebody will create an indexable search, maybe paid access for employers - instead of open access for public. Not a good thing.
- ultrasounder 8y agoIt's all about TC this TC that tho occasionally one might be able to glean some Leetcoding tips. But generally degenerate.
- dmode 8y agoLike any anonymous forums, Blind is toxic. Hope it dies a quick death
- huac 8y agowould you consider hacker news to be anonymous?
- whymauri 8y agoWhile you can choose to be anon on HN, I think the culture of HN tends away from that. People will use recurring internet handles, write informative bios of themselves, etc. I suppose nothing stops people from doing this on Blind, but like I said I think it's a cultural difference between platforms. There is less moderation on Blind, so there are more "provocative posts" that people definitely do not want associated with an identifier.
- village-idiot 8y agoI don’t think anonymity guarantees toxicity, but anonymity without any sort of rule enforcement sure seems to guarantee toxicity.
- ggggtez 8y agoI agree, though the "stated purpose" of the site being to anonymously complain about coworkers probably doesn't help it stay as a positive environment for intelligent discussion either.
- chillacy 8y agoFor all the toxicity blind is one of the best resources to discover comp info online, since sharing salary is still a bit taboo. Some of it is e-statting but I’ve found it to be useful for when you negotiate comp.
- haditab 8y agoThere's so much misinformation on it I find it hard to trust. I prefer to go with H1B salary databases.
- quickthrower2 8y agoUse 4chan as 'anonymous' instead. Or better, a throwaway account on HN. Remember your VPN.
- Vadoff 8y agoWait, Blind doesn't use end-to-end encryption?
- pointcloud 8y agoHow to use end-to-end encryption on a forum?
- deleted 8y ago[deleted]
- jiveturkey 8y agothe whole concept of blind is faulty! there is no way you could trust them to maintain your privacy. and of course they can read all the dirt on everything. it’s a guarantee they have no meaningful controls in place.
- jiveturkey 8y agotoo late to edit. wanted to add, with all the recent (and we know to be continuously ongoing) talk about chinese espionage ... who needs high-cost espionage when you can get employees to air dirty laundry at zero-cost?
- ap3 8y agoLove Blind - it has been great help during my job search
- randomacct3847 8y agoI stopped reading after reading a thread of grown men throw hissy fits because they thought they were screwed over by their $300k salary when they felt they “deserved” $400k+
- sidlls 8y agoIt never fails to amuse me how a worker desiring a better wage is something frequently and deeply mocked here.
- hknd 8y agoI enjoyed blind during their early days, now all threads are the same: "HEY, starting at company XYZ at level N, with total comp of YYYY. Is that good" "No, that's not possible you are lying!" "Hell yeah, well done mate" ...
- mosselman 8y ago"Uber — which later blocked the app on its corporate network." Reason enough not to work there if you ask me.
- aryamaan 8y agoI don't think this claim is true. Friends who work there clarified they can use Blind at the corp network.
- uber-employee 8y agoNo, it’s true. This was right after the Susan Fowler event when Uber’s Blind channel blew up in membership. They blocked it, people just laughed and turned off wifi, and then they unblocked it a few weeks later.
- aryamaan 8y agoAlright. Sorry, I took it as it's banned at the moment too.
- dgzl 8y agoThis bothers me: > The database also contained passwords, which were stored as an MD5 hash, a long-outdated algorithm that is nowadays easy to crack. Many of the passwords were easily unscrambled using readily available tools when we tried. That's not how hash functions work... > Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.” This sounds much more likely. > (Logging in with an email address and unscrambled password would be unlawful, therefore we cannot verify this claim.) So, they directly claim that weakly hashed passwords were available (and unscramble-able, apparently??), but they're unable to prove this and they're ignoring the company's reasonable explanation. Great reporting.
- CuriousSkeptic 8y agoSHA2 isn’t any more reasonable. You _can_ use sha with a proper key derivation function. But just saying that sha2 somehow improves on md5 without additional context indicates to me that you haven’t understood the problem.
- free652 8y agoThe passwords were md5 hashed and most likely broken using dictionary attack or brute forced with tools like hashcat. I forgot my password once, but I knew the general letters and it brute forced in a minute.
- dgzl 8y agoYeah weak hashes are easy to replicate, I was just laughing at the words they used.... Unscramble, like it's an encryption method or something.
- zaroth 8y agoIt sounded more like you were trying to discredit the report. The terms are well accepted laymen terms to use when talking about cracking passwords.
- blahblahblogger 8y ago> Blind claims on its website that its email verification “is safe, as our patented infrastructure is set up so that all user account and activity information is completely disconnected from the email verification process.” Wow a patented infrastructure! Dope! I wonder if it's open source so that can be validated objectively?
- nathanvanfleet 8y agoI guess you can at least look up the patent and validate the idea.
- seveneightn9ne 8y agoTechnically that is the point of patenting - it should be available for anyone to read how it works. Do they specify the patent number?
- tomphoolery 8y agoWhen I deleted my account it said "you will be unable to recover your password through Blind" Heh, guess I could just use this table of hashed passwords that they exposed and figure it out myself ;-)
- toss1 8y agoTheir core functionality is to keep the confidentiality of its users. There is widespread available technology and know-how on how to do this successfully and consistently. Blind failed miserably at this fundamental task. Yet... >>Blind last month secured another $10 million in new funding after a $6 million raise in 2017 So the VCs are perfectly happy to dump millions into a company that is dishonest and incompetent (see also Uber, Theranos), while thousands of competent honest startups go begging. Provides a bit of background into why most VC funds struggle to outperform the market
- drngdds 8y agoUsing Blind with your company email on the company WiFi seems really dumb? Maybe I'm paranoid, but I act as though everything that goes through my company WiFi and on my company computer is being tracked and stored in some database forever under my name. And I assume the company email is used to send you a verification email, which means your employer is now tipped off to the fact that you're using a site to anonymously criticize them.
- rootsudo 8y agoCorrect, it's very easy to find out who in the company is on Blind -- most corporations use Exchange. Easy as this: http://ivan.dretvic.com/2011/05/remove-specific-email-from-all-mailboxes-in-exchange-2010-sp1/ http://ivan.dretvic.com/2011/05/remove-specific-email-from-a... The article says "remove" but before you remove, you need to list all employees that have that email - if you just make a test account or look for the domain then you can pipe the results to a text file and that's your list of company insiders who are on the platform. What leadership does with that info, is well, never good.
- yanslookup 8y agoPosted above but someone at my org sent an invite to everyone. Having a list of everyone that received an invite does not mean they signed up...
- rootsudo 8y agoNo, but people who did have an email confirmation. You can search not only from domain sent, but from subject and body.
- yanslookup 8y agoWhat? The invite email from blind is the email confirmation from blind...
- yanslookup 8y ago
- simonebrunozzi 8y ago"Blind claims on its website that its email verification “is safe, as our patented infrastructure is set up so that all user account and activity information is completely disconnected from the email verification process.” "Patented infrastructure"? It smells like BS to me.
- firemancoder 8y agoThey say "anonymous" but right after signing up with my work email they followed me on Twitter. The two are only connected by my name. Could be coincidence, but probably not. Also, the community there is pretty toxic. I understand it's mostly the design of the app to be a place where people can say what they want, but I think it attracts a certain type that I'm not terribly interested in getting close with.
- jiveturkey 8y agohttps://www.teamblind.com/faqs https://www.teamblind.com/faqs > Email verification is safe, as our patented infrastructure is set up so that all user account and activity information is completely disconnected from the email verification process. https://patents.google.com/patent/US9439072B2/en?oq=9%2c439%2c072 https://patents.google.com/patent/US9439072B2/en?oq=9%2c439%... > Certain embodiments herein also provides a system and method for authentication, which can prevent service users' identities from being exposed even by hacking of a terminal or server side of a service provider, negligence in information management or a manager's misconduct. impossible. > Certain embodiments herein also provides a system and method for authentication, which can store information provided by a service user during subscription and authentication procedures in such a manner that the information cannot be decoded from a side of a service provider's server. Impossible without a trusted 3rd party to perform the authentication and return a token to the service provider. Which is a well known and well deployed, not novel technique. Patents are hard to read, and this one is no exception. Unfortunately I don't have enough interest to invest the time required, but at a glance it seems that the technique is to have an authentication server that can hide the user identity from the relying service, basically by replacing it with a token. Too obvious. But there's some kind of dedup exchange mentioned; it might be that the auth server doesn't itself store a list of the identities that it has authenticated previously so it has to interact with the service (in a blind way) to dedup. Perhaps the novelty here is that the service itself cannot uniquely identify users; ie each post could be coming from any user in a group. All the service knows is that the post is from a user in that group. On its face, that seems false -- for the first time ever I actually looked at blind and each post has a user pseudonym as metadata. There would be no point to that pseudonym if it didn't represent a uniquely identified individual user. Anyway, all this is meaningless protection unless there is adequate SoD between the auth server and the service provider, which for teamblind it is obvious there is not.