9 ms·
Your Username Will Now Serve as Your Password and Your Password as Your Username
- rch 16y agoIs it April 1st already?
- nekgrim 16y agoThat's a lot of "azerty" accounts...
- nathanb 16y agoGood point...unless they require unique passwords (huh?) or disambiguate username clashes via password (double huh?), seems like this wouldn't work very well at all.
- joelhaasnoot 16y agoOr the password is the subscriber number and the username was their email. Happens often that the online access for a periodical is your subscriber number found on the address label.
- bcasiello 16y agoNice... "Your password must be unique. Password 'mybirthday' is already in use by 'fred_bloggs'. Please try again."
- gst 16y agoThey are based in the US, so I think that the amount of their users that use a French keyboard layout is quite small.
- nekgrim 16y agoThis also works with "qwerty" (i thought something was wrong the first time, but couldn't find what, thanks !)
- slmbrhrt 16y agoWell, the one on the right was on the bottom And the one in the middle was on the top And the one on the left got a broken arm And the guy in the rear, said, "Oh dear"
- dhimes 16y agoWhere's johnnycache when you need him? ;-)
- WestCoastJustin 16y agoStrange, my account name is now 'password' and it seems there are many duplicates! Shoot!
- blantonl 16y agoMy password is 12345 and I cannot figure out why my login is failing now, even with this change. Edit: you know, now that I think about it they could be using Javascript to generate an MD5 hash of the username, which is now the password, and submit that to the login form. But....
- bricestacey 16y agoThe library I work for actually does this. Their last name is their password and their barcode is their username -- yet we display forms the other way around to make their account look more secure (cuz a last name is obviously not a secure password). It's stupid, but works.
- marshray 16y agoHow do you change your password?
- reinhardt 16y agoBy getting married and adopting your (new) husband's/wife's lastname, apparently.
- lamnk 16y agoI want to change my password. Now!
- pavel_lishin 16y ago"Honey, will you change my library password?" (Pulls out ring.)
- bricestacey 16y agoPeople cannot change their password. Whatever the system has for your last name is your password. This is common in libraries because a) your barcode is assumed to be mildy private and b) online access to your account doesn't give you access to physical objects (even if you request something, we require barcodes and picture ID to circulate the item) thus mitigating any financial losses to the user. This does raise concern regarding unauthorized access to licensed content. If you google for EZProxy logins you can find dozens of lists of accounts to Universities. My experience is that libraries rely on publishers to ulinately report abuse though at which point we suspend the barcode and issue a new one to the legitimate user.
- philjackson 16y agoPutting aside the issues we all know exist with this, I wonder what their rationale was...
- j_baker 16y agoProbably some variant of "Whoops. We named the username column 'password' and the password column 'username'. Guess we need to fix this!"
- jedsmith 16y agoThat sounds like it would be a fun system to inherit.
- BoppreH 16y agoMaybe if you use the Dwarf Fortress term. "Losing is fun!"
- lukifer 16y agoI've seen far too many codebases that use the order of the returned fields rather than the field names. Scary.
- state_machine 16y agoBut it's faster that way, and you don't have to store the name in every row like with those No-Seequill whatnots. </sarcasm>
- uxp 16y agoYour closing sarcasm tag isn't warranted, in a large number of circles.
- Dilpil 16y agoAye, me as well. And later written my fair share of them when the going got rough.
- epenn 16y agoPasswords as usernames, human sacrifice, dogs living with cats. Mass hysteria! Seriously though, I can't understand what their rationale for this would be. Not to mention, as other commenters have pointed out, how they will handle all the users whose former passwords were common phrases like password, secret, ilovebieber, etc. will now be duplicates.
- jarek 16y ago1. "SELECT * FROM Users WHERE Username=\"" + $username + "\" AND Password=\"" + $password + "\"" 2. Don't allow changing usernames, unlikely to allow changing passwords 3. Indexes? What are indexes?
- jedsmith 16y agoHa! Where's your bcrypt now, suckers?
- biot 16y agoOdd... why is my username now $2a$11$xhZJBhGhnD9yy8nwTWxif.Wrg1sbfs5pFyhLuscGvpVKMCPgq8WLG ?
- aurumaeus 16y agoMy hometown paper, growing up. Seriously, though...
- reduxredacted 16y agoDiscounting the absurdity angles of all of this, there is always one positive: We'll all have an opportunity to update our list of disallowed passwords. The usual suspects will be there (within the parameters allowed by the application), but there will be new ones to add to the list.
- user24 16y agohttp://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ (PS: most of the comments on this item aren't very useful. Try to be useful when commenting, even in the face of stupidity such as this)
- jedsmith 16y agoOn this submission? Come on. You obviously grasp that some submissions are lighter-hearted than others, otherwise you wouldn't have left http://news.ycombinator.com/item?id=2307252 http://news.ycombinator.com/item?id=2307252 on the mspaint.exe expressed as PCM item. Since you edited out "be useful or go elsewhere," I know that you're thinking your orders to us are a bit across the line, too. They are. Might as well finish it off and edit them all the way out. Now, on to your URL: I've tired of people mindlessly chirping the bcrypt approach for storing passwords, particularly that very blog post, when really there is absolutely nothing wrong with hashing. This line particularly irks me, amongst others: > Salt or no, if you’re using a general-purpose hash function designed for speed you’re well and truly effed. The author glosses right over keeping a separate salt (shared secret) outside of the database itself, so that you need two separate compromises -- application code and database -- in order to retrieve plaintext passwords. He also claims that "salts won't help you" plain text full stop, without justifying that remark well in the article, and completely avoiding their utility at preventing a rainbow attack. Instead, the entire article resorts to fear mongering, and I'm tired of people citing it. I will continue using hashing, and watch as the Anonymous groups and so on pick off the low-hanging fruit. If you mindlessly copy and paste that URL to me without fully and objectively understanding the implications of what you're implementing, and why bcrypt might not be right for you, you really should step back and rethink your decision. In particular, if your app is handling a lot of logins, you're going to become CPU bound extremely quickly. Using the author's benchmark of 0.3 seconds for a simple password hash, how many simultaneous login attempts do you think it's going to take to saturate a core?
- Xk 16y agoI agree you that this article has nothing to do with salting, and I don't know why the grandparent comment was even made, but there are a few points I would like to make about what you've said. > when really there is absolutely nothing wrong with hashing. Hashing is millions of times better than storing the plaintext. Adding a salt probably increases the workload by about as much as going from salted hash to bcrypt [constant time lookup in rainbow table -> exponential time in length of password -> higher constant factor exponential time]. But I must disagree with you saying there's nothing wrong with hashing, however. There is something wrong with hashing, and that is that it's possible to brute force many passwords. However you're perfectly right that going hash+salt to bcrypt doesn't do nearly as much as going from plaintext to hash+salt. And you're also right in that the simple passwords will fall anyways. You could have it take 30 seconds per password and an attacker could still get the passwords a couple percent of your users (who picked '123456', 'password', etc). If I pick '$yN3,A%2vq{-', no matter if the server is using MD5-crypt or even scrypt, you won't be getting my password. > you're going to become CPU bound extremely quickly This is one of the only valid criticisms of bcrypt, and it is a significant one. One of the nice things about it, though, is you don't have to use the 0.3 second time. That's just chosen arbitrarily. If you think that's too high, then go with 0.03 seconds, or 0.003 seconds. Surely you can deal with that requirement. Granted, brute forcing is now 1000 times faster -- but hey, it's 1000 times slower than bruteforcing a hash. Anyhow, I don't disagree with most of what you're saying. I just wanted to point out that it's still possible to go with bcrypt by just decreasing the workload to a reasonable level for your application; I'm not trying to say you're wrong.
- jhrobert 16y agoThey should make the "order" irrelevant. ie silently retest using password/username reversed. What are the chances that both (password,username) and (username,password) succeed? Very low I guess. If it ever happens, reset password and send a mail about that (on both accounts).
- pepijndevos 16y agoThis might actually be a security improvement, with people choosing names with numbers and capitals in them, and ridiculously stupid passwords.
- uxp 16y agoBut do they have a "recover username" form that requests your already known password?
- nek4life 16y agoWhat the hell is my home town's newspaper doing on the front page of hacker news? I'd be lying if I didn't believe that they would do something this stupid. They recently put the site behind a pay wall and I can no longer catch up on hometown news as a result. Who ever running that business is an idiot.
- travisglines 16y agonek4life, where are you from St. Jay? I'm from Littleton myself and was pretty dumbfounded when I found the Caledonian Record as the #2 result on the front page of HN. I actually just signed my grandmother up to their service here and all it is, is a paid subscription to pdf copies of their newspaper as they release it. Theres not exactly much to protect there and worst case scenario is that someone gets some free copies of the paper. I don't think its such a big deal for them to be a little lax with password security given what you get behind the security wall. (as long as people aren't using that same password everywhere ... which may be the real problem here)
- reemrevnivek 16y ago> as long as people aren't using that same password everywhere Most people do reuse passwords. That's the reason this is significant. It wouldn't be newsworthy if a service like this screwed up and made getting free copies of the hometown newspaper easy.
- nek4life 16y agoYeah I'm from St. Johnsbury but now I'm currently living in Burlington, VT. I was in total shock seeing the caledonianrecord.com domain on the front page. They used to have the actual articles online so I'm surprised to hear that they switched over to publishing the pdf's instead but that probably makes sense as the staff doesn't have to web publishing skills (as easy as that seems to the people that are reading this.) The switching of the username and password baffles me but perhaps they gave out generated usernames and passwords to begin with so it wasn't such a big deal. Although I'm really questioning the logic right now.
- LilValleyBigEgo 16y agoI can't help wondering how this happened.
- stevenp 16y agoAnd they said that print news was dying due to the industry's inability to innovate... Pfft!
- reemrevnivek 16y agoI assume someone has already emailed this guy? Reed Garfield, Information Technology [Snip] Joined the Caledonian in 1963 Reed is among the longest tenured employees of the paper. Though technically retired from his long held position of Production Manager, Reed still makes vast contributions to the daily operation of the Caledonian through his mastery of technology systems. He has three grown children and lives in Lyndonville with his wife. Related Links: • Email Reed... garfieldr@caledonian-record.com
- 16s 16y agoNo need to berate the guy. We've all made silly mistakes before. Yes, I know that this is bad, but there's no need to send him harassing emails.
- reemrevnivek 16y agoSorry, I wasn't advocating berating the guy. There is a need to send him one email, saying "Hey, noticed you made a mistake. It's pretty public (see hackernews), and you should fix it soon. Hope that helps!" I hoped that someone would reply, saying, "Yup, I emailed him." and thus mitigate the potential flood of email. Since there was no announcement on the website to the tune of "Whoops, we made a security blunder, you'll have to do X to log in now", I assumed the guy was oblivious.
- pdaviesa 16y agoWTF?!
- skid 16y agoIt's silly how this is actually becoming the truth. People use the same password and different usernames for different sites. In the end, remembering your username becomes the problem :)
- lloeki 16y agoAlso, with all those silly passwords in use, the information entropy bits lie in the username.
- moxiemk1 16y agoThis is my hometown newspaper - I saw this the other day when looking for an article... is there any good reason for this? I cannot fathom what's going on. For what it's worth, the opinion of the paper myself and those I know have had is that it's rather poor quality, but there's not enough market for competition.
- po 16y ago... also your username is now 0fa9d314017d68a235015a9344bc9c09bbe87ec3
- ilovecomputers 16y agoWonderful, do you know how accounts I have to change because of this reckless post?
- Trufa 16y agoHoly potatoes, I'm truly and deeply dazzled.
- throwaway212121 16y agoNot unsurprisingly, x' AND email IS NULL; -- works as the username with no password. Injection FTL.
- lloeki 16y agoSo much for the security change. I thought that kind of injection was really a thing of the past. Injection is the web segfault.
- FaceKicker 16y agoGood find, though I don't think most of it is necessary. It seems like any username that includes a semicolon at any point will authenticate. I can't imagine what their code would have to look like in order for that to happen.
- pavel_lishin 16y agoEspecially considering they're actually paying monthly for it. http://news.ycombinator.com/item?id=2330694 http://news.ycombinator.com/item?id=2330694
- jp_sc 16y agoAnd the saddest thing is they're actually paying monthly for that CMS. See the source code and then http://www.going1up.com/main.asp?SectionID=6&SubSectionID=7&TM=85887.3 http://www.going1up.com/main.asp?SectionID=6&SubSectionI...
- ankimal 16y agoSEO trick? Get people all over the Internet talking about this insane "Security Change" and increase hits. (Would love to see analytics on this). Would be surprised if it will last. Oh well, 15 minutes of fame or in this case infame.
- elai 16y agoOh, so it's like a credit card!
- cromulent 16y agoAh, that little Bobby Tables. What a prankster he is.
- nilesh4life 16y agoDo we then need even a username?
- rboyd 16y agoYou see negligent security practice. I see clever marketing ploy.
- wilhil 16y agoso... Username = "wilhil" Password = "asdfghjkl" Username = Password Password = Password Username & Password = the same?