3 ms·

The parent comment is likely referring to admin & username passwords for people working at Gawker Media, such as Gizmodo, Lifehacker, and Kotaku contributors.

by alanh 16y ago

The parent comment is likely referring to admin & username passwords for people working at Gawker Media, such as Gizmodo, Lifehacker, and Kotaku contributors. All the usernames and passwords for users with {@lifehacker.com, @gawker.com, etc.} email addresses in the torrent (plaintext, not hashed). The torrent claims Nick Denton’s password was an 8-character sequence of even numbers, and that he used it everywhere. (Edit in reply: The hackers used this on e.g. his Twitter account IIRC so it wasn’t truncated to 8 characters.) Some of them are even '11223344' or a substring of the author’s username!

wahnfrieden 16y ago
This isn't entirely accurate. Their hashing mechanism only hashes and stores the first 8 characters of the password. So you only need to get the first 8 right, even if the password is 12 long. That also means that, although unlikely for some, '11223344' could have actually been '11223344aBc$!q'. Not that it would have mattered though!
- 27182818284 16y ago
  It matters a little outside of Gawker, right? Because a site that requires all of say, 12 characters, if the remaining 4 weren't predictable, would be safe even with the first 8 exposed.
  - alanh 16y ago
    Yeah, but only as “safe” as a 4-letter password. Assuming full alphanumerics, that’s only 14 million possible 12-character passwords to try. Given a 1GHz processor, well, you see where I’m going with this. This is why I freaked out when bluehost.com (AVOID!) required the last four characters of my password to accompany support requests(!).
    - 27182818284 16y ago
      Yeah I was just using the 12 as an example, but someone with say 36 chars past the 8 recovered from gawker should be a little more at ease. I don't think I've logged into any of their sites, I use different passwords at different sites and they are generally > 20 chars, so I'm not worried. Yet, at the same time, even knowing all of that, I did a bit of a double take and had a brief "Oh shi-" moment of paranoia when I read the headline. In fact, if I were say a young starlet that used a similar password for my private email or something as my Gawker account, I'd be really freaked!
    - lukeschlather 16y ago
      Realistically, this isn't likely to compromise a strong 12 character password without a second breach at a different site. (In order for your 1GHz processor to have any bearing on the discussion, they need not only Gawker's password hashes, but another site you coincidentally have an account at that uses the same password.)

by alanh 16y ago

wahnfrieden 16y ago

This isn't entirely accurate. Their hashing mechanism only hashes and stores the first 8 characters of the password. So you only need to get the first 8 right, even if the password is 12 long. That also means that, although unlikely for some, '11223344' could have actually been '11223344aBc$!q'. Not that it would have mattered though!

27182818284 16y ago
It matters a little outside of Gawker, right? Because a site that requires all of say, 12 characters, if the remaining 4 weren't predictable, would be safe even with the first 8 exposed.
- alanh 16y ago
  Yeah, but only as “safe” as a 4-letter password. Assuming full alphanumerics, that’s only 14 million possible 12-character passwords to try. Given a 1GHz processor, well, you see where I’m going with this. This is why I freaked out when bluehost.com (AVOID!) required the last four characters of my password to accompany support requests(!).
  - 27182818284 16y ago
    Yeah I was just using the 12 as an example, but someone with say 36 chars past the 8 recovered from gawker should be a little more at ease. I don't think I've logged into any of their sites, I use different passwords at different sites and they are generally > 20 chars, so I'm not worried. Yet, at the same time, even knowing all of that, I did a bit of a double take and had a brief "Oh shi-" moment of paranoia when I read the headline. In fact, if I were say a young starlet that used a similar password for my private email or something as my Gawker account, I'd be really freaked!
  - lukeschlather 16y ago
    Realistically, this isn't likely to compromise a strong 12 character password without a second breach at a different site. (In order for your 1GHz processor to have any bearing on the discussion, they need not only Gawker's password hashes, but another site you coincidentally have an account at that uses the same password.)