16 ms·

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

279 points by aero-glide2 5y ago

m3adow 5y ago
> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Ouch! I hope they learned their lesson: Security is an ongoing effort.
- ilogik 5y ago
  for 2006 that's actually not bad. When I joined my first company in 2010, to my horror, they were using plain text passwords for users
  - labster 5y ago
    My first company was using MySQL’s OLD_PASSWORD() function in 2013 — straight, with no salt or spice of any kind — in its 64-bit glory. Horrified, I did some research and threw bcrypt up there right away. Not sure if it was my my first commit, or the branch fixing 20 or so SQLIs was the first. I became my company’s software security expert out of sheer terror.
  - BlueTemplar 5y ago
    Yeah, just last month I was shocked to see a shop where I forgot my 2017 password, to send it to me. in plain text. by e-mail. (at least IIRC they used HTTPS on their website !)
- burai 5y ago
  16 years without reviewing password security seems like a massive oversight. A major leak like this it's a high price to pay to learn this lesson.
  - foxtrottbravo 5y ago
    The really bad thing is that md5 was considered broken in 2005 by security people like Bruce Schneier. To be fair to them it took till around 2008 for this to become widespread opinion but the signs were on the wall around 2004
    - GoblinSlayer 5y ago
      You believe sha256 would drastically improve password hashing, being a not broken hash function? In 2006 they likely ran php4 and didn't have much choice what hash to use.
PikachuEXE 5y ago
Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.
- lillecarl 5y ago
  I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use). BitWarden is open source, both server and clients. There's even a third party implementation of the server in rust that seems to be mostly compatible. Both the official and the third party server are self-hostable. BitWarden runs their infrastructure on Azure, uses Azure managed databases and Azure managed backups. So I'm quite comfortable having my passwords there. The only feature I miss is that I'd like BitWarden to send me an email with all my passwords, encrypted so that I own a backup of my data too in case the worst happens.
  - toyg 5y ago
    > TOTP integrated into the password manager Is this portable, like Authy does it? Last time I moved phone it was a real pain to move authenticators...
    - lillecarl 5y ago
      Yes, you have the same TOTP keys in both your phone and browser ext
  - diarrhea 5y ago
    > There's even a third party implementation of the server in rust that seems to be mostly compatible. Not just mostly. Vaultwarden also offers server-side features usually only found in paid Bitwarden plans.
throwaway834343 5y ago
What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that would be amazing. Thanks HN
- erklik 5y ago
  > I can not believe the motivation can simply be to get subtitles to watch movies personally Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?
  - szszrk 5y ago
    Well, not when licensed entertainment is involved. Subtitles may sound harmless but are enough to start a court battle. This happened in Poland with a similar site. I would not dare to claim that authors motives and all actions were clean and done in the open, but for sure they were targeted by various media groups for copyright infringement just because of plain subtitles. You need resources to deal with that and it's not gonna be a clean fight.
  - lawtalkinghuman 5y ago
    > Does everything require a money motive? On HN, apparently. See the recent thread on Wordle. The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it. It is depressing that HN participants are so often mystified by the idea people might be motivated by intrinsic or social factors to engage in peer-based production (whether legal or not) when so many of the companies they run or work for exist only because of peer-based production efforts like Linux and other FOSS software.
    - throwaway834343 5y ago
gattilorenz 5y ago
> Tue Jan 18, 2022 2:34 pm > In August 2021 we received message on Telegram from a hacker, who showed us proof that he could gain access to the user table of opensubtitles.org, and downloaded a SQL dump from it. Wait, they got proof in August and release the info only now? Was this because they were trying to be in a talk with the hacker? It wasn't really clear, but it's a long time...
- Deukhoofd 5y ago
  They explain more here: https://forum.opensubtitles.org/viewtopic.php?p=46845#p46845 https://forum.opensubtitles.org/viewtopic.php?p=46845#p46845
  - wasmitnetzen 5y ago
    So, still a wrong procedure. They should have told everyone to renew their password and view them as compromised in August. Edit: typo
    - gattilorenz 5y ago
      > nothing was leaked in august, we followed the hackers request, secured our services, hired an extra sysadmin, ran extra audits. Oh yes, what could ever go wrong with keeping already compromised passwords? Plus it was clearly a white hacker that helped them secure the website, the required fee was for this service. /s
      - aniforprez 5y ago
        It's truly appalling that so many times, on HN even, people genuinely recommend paying the ransom because "hackers won't go back on their word cause it'll ruin their reputation". If you're hacked, purge the passwords and reset everyone and do everything in your power to ensure no one can access it in a similar way again. I have no idea why anyone would think a hacker wouldn't simply turn around and sell the data anyway
franciscop 5y ago
> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed passwords are rainbow tables). At least with salt+pepper it limits attack surface, but instead you should be hashing your passwords with: - `password_hash`[1] should be used instead of `hash_hmac`, with the algorithm being "PASSWORD_BCRYPT" or better[2]. This is a slow hashing method, meaning anyone trying to rainbow-table attack your passwords will have a hard time. - A common technique is not to delete old passwords, but instead to rehash them with the new algorithm. This would be useful for moving from sha256 => bcrypt, since collisions on sha256 are not practical, but if the original hash was md5 then I think it's fine to delete the md5 passwords and require a new one. Good luck to those who changed their email in 15 years though. [1] https://www.php.net/manual/en/function.password-hash.php https://www.php.net/manual/en/function.password-hash.php [2] I haven't followed the space too closely for 3-4 years, I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones
- joren485 5y ago
  > I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones While bcrypt is already much, much better than using MD5 or SHA256, the best practice is to use Argon2. In practice, it is more important to use a hashing algorithm that is designed for passwords (e.g. bcrypt, argon2, scrypt) than it is to choose the best one. As this breach shows, many sites are still using insecure hashes, like MD5, because it worked 15 years ago.
  - brobinson 5y ago
    Which mode do you/would you use? Hybrid? I haven't had to write any password storage code since before Argon2 won the 2015 competition so I haven't gone deep on the "side channel attack vs. memory hardness" tradeoff question when picking the mode. I am curious which mode others are using.
stubish 5y ago
At one point I think you could use opensubtitles.org without a username and password. I wonder in hindsight if the liability of storing PII was worth it?
- pizza234 5y ago
  I think one use case was subtitle downloading (typically, a client like Subdownloader) for VPN users, whose requests would be denied if unauthenticated.
  - pferde 5y ago
    Why? The site's raison d'etre is to make subtitles readily available for downloading by anyone. What is the purpose of locking it behind authentication? What did that realistically achieve?
    - drexlspivey 5y ago
      API REQUESTS MUST BE AUTHENTICATED With Covid-19 pandemic requests for our API went skyrocket, our servers could not handle so much traffic, so we decided to limit API usage just to authenticated requests for User Agents. In short it means, you have to provide opensubtitles.org username and password in LogIn() method. We are avare some of user agents doesn't implement authentication for numerous reasons. What you can do for fix, if your app is affected: - let your users know about this change - implement LogIn() into your app with user authentication - contact us for pricing, so your app can send unathenticated requests (e.g. if you have free and pro version of your app, it is possible free will work only with authenticated requests and pro works as before) More info on [our forum](https://forum.opensubtitles.org/viewtopic.php?f=11&t=17110 https://forum.opensubtitles.org/viewtopic.php?f=11&t=17110) We are actively blocking IPs, which are sending unathenticated requests
    - pizza234 5y ago
      Spam was one reason (I've actually asked to the admins, which were very pissed off by it).
theplumber 5y ago
Why do we learn that passwords are obsolate and webauthn is the only sane choice?
- 8organicbits 5y ago
  I believe webauthn requires end users to perform key management. I suspect that is currently a harder task for the average user than a memorized or written-down password. Special hardware tokens may help, but I'm not sure how we'd convince average users to care or buy them. Are there any webauthn only sites, besides demos?
  - nybble41 5y ago
    The end user's agent (browser) should handle the key management behind the scenes. Even without hardware tokens it's still at least as good as a software-based password manager. A Hierarchical Deterministic key system similar to the BIP32 scheme used by most Bitcoin wallets[0] would only require a single master private key per user to support any number of unrelated identities. That key could be generated from a master password, synced to each device through an enrollment process, or stored on a hardware token. [0] https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...
    - 8organicbits 5y ago
      This is new to me, thanks. Do you know how that supports use cases like if someone wants to change their flight from a hotel computer? I wouldn't want to expose a "master password" to a computer I didn't trust.
      - nybble41 5y ago
        If you don't trust the computer then your best option is a hardware token like the Trezor (which already supports WebAuthn in addition to its cryptocurrency functions). The better ones will include a screen where you can see details like which site you're signing into before confirming the request. Either way, the host computer never gets access to any private keys. It can still do whatever it wants with your login session on that site, though, so you'll want to be careful about logging in to sensitive sites from untrusted PCs. The same applies to password-based logins, of course; moreover, any password you've entered into a public PC should immediately be considered compromised and changed (from a secure device) at the earliest opportunity. Given any choice in the matter I would suggest using your own equipment to change the flight (e.g. a smartphone), even if it's less convenient.
johnchristopher 5y ago
Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surface for not much benefits to users (and probably themselves). edit: at the time I also was young and naive [0] and thought the open part of opensubtitles meant that people submitted subtitles in their free time out of their good heart and the site was simply hosting and organizing them, no problem with displaying ads on the website or at the beginning of the subs I thought, to make up for hosting costs. Subs hunting was so much fun at the time /s. But having to register to "prevent abuse" was a tad too much. [0] still am by the way, thanks for asking :)
- mkdirp 5y ago
  > Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). This was actually optional, and always was. I think the issue was that they had made some changes in the backend, but the addons didn't update the code to accommodate. At least this was the case for Kodi. The opensubtitles addon has essentially become abandonware anyway. There are now third-party addons that provide the same functionality but without a login, and across different subtitle websites.
  - morrbo 5y ago
    Can you name a few please?
    - Liquix 5y ago
      https://github.com/a4k-openproject/a4kSubtitles https://github.com/a4k-openproject/a4kSubtitles anonymous, scrapes a handful of sites including opensubtitles + subscene
      - 5y ago
martin_a 5y ago
> It is kind of amazing, that the site was hacked now, after 15 years - so that hacker must have spent quite a lot of time and energy on it. I'm pretty sure that it did not take "that hacker" 15 years to find this vulnerability. Pretty strange forum post.
- Aeolun 5y ago
  Website still managed by a just graduated 21 year old?
  - diarrhea 5y ago
    A prodigy at 6 years old back in the day.
    - Aeolun 5y ago
      Lol, I meant to imply the site changed owners over the years ;)
  - Markoff 5y ago
    he is not that young, roughly my age around 40 living in Ko Phangan here are his videos since his website is dead and he is also not active on twitter anymore https://www.youtube.com/user/BranoGege/videos https://www.youtube.com/user/BranoGege/videos
iqanq 5y ago
>The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt That's a good excuse for it to be like this in 2006. What about 2021?
YPPH 5y ago
>On the technical side, he was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data. It can be tempting to forgo the same security considerations when programming backend applications which aren't ordinarily accessible to the public. I guess this is a reminder why the temptation must be resisted.
begueradj 5y ago
You did right: no need to pay the ransom.
- baobabKoodaa 5y ago
  I'm confused. Didn't he say that he DID pay the ransom?
  - begueradj 5y ago
    My bad, you are right. He said they paid. The short history of ransomware shows whenever the ransom was paid, the attackers came back again to threat and solicit more money. It's advised not to pay. But only the business owners could have the right "feeling" as they are the only ones who communicated with the attacker(s)
morelish 5y ago
I wonder how the hacker got network access to the database? I couldn't work out from what I read. It said the DB had a weak superuser password. But it didn't say how the hacker managed to make network calls to the DB. Presumably there was some initial entry point to get inside the network? It sounds like maybe the web-application user verification was poor and the app allowed admin users to make arbitrary DB calls?
- mustardo 5y ago
  > was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data. Depending on the injection vulnerability data can be exfiltrated, there are tools like sqlmap https://sqlmap.org/ https://sqlmap.org/ which make it pretty easy to dump tables via injection
  - morelish 5y ago
    Ah I see, it was the website user SuperAdmin the hacker got into. Cheers.
    - mustardo 5y ago
      Thats my understanding, I initially thought MySQL root user as well
gsich 5y ago
I recommend subscene.com for a no-hassle way to download subtitles.
Aissen 5y ago
A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.
- stevewodil 5y ago
  Slightly related, in order to prevent super long passwords from eating up CPU time is it better to hash using sha256 before argon/bcrypt so that the length is constant, or is it better to limit password length to some arbitrary number like 64 characters
  - l-lousy 5y ago
    I think an average user password would be shorter than a sha256 hash no?
    - LeifCarrotson 5y ago
      Bcrypt truncates to 72 bytes, so it's kind of irrelevant IMO. Whether your average length is 12 or 20 or 64 bytes doesn't matter much. I expect the parent's concern came from experience with PBKDF2, where the length is unbounded. It's good to consider possible denial of service attacks: if someone submits an enormous 1 MB password a PBKDF2 hasher can be knocked offline for 60s. Sha256 will quickly crunch that attack to a more manageable length.
      - stevewodil 5y ago
        Exactly this, it’s a vector for DOS
  - 8organicbits 5y ago
    > Many implementations of bcrypt truncate the password to the first 72 bytes, following the OpenBSD implementation. https://en.m.wikipedia.org/wiki/Bcrypt https://en.m.wikipedia.org/wiki/Bcrypt This sounds undesirable to me, so I'd support sha256 and an alternative. I'd also recommend adding a max password length to any API. No point in allowing million character passwords.
korginator 5y ago
By now I assume that any service where I've registered for an account is being actively targeted and that any organisation that's not a Google, Microsoft or the likes has already been breached. MFA is your friend, and even plain vanilla SMS based MFA is better than just a username and password for authentication. I've enabled hardware based MFA anywhere it's supported. 15-20 years ago it was fun to sign up for dozens of new services and we reused passwords everywhere. Now every one of these accounts is a liability and a potential vector for bad things to happen. The worst case scenario is when an account of yours is breached and abused for a long time, possibly with legal and financial ramifications, and you don't find out until much later. A couple of months ago I happened to glance at my Gmail's spam folder by chance, and one email way down the list immediately grabbed my attention. The subject line had *my password* for an old and unused account that I'd forgotten long back and the sender was trying to extort bitcoin if I wanted the account back. The big issue is with online shopping. The sender has your name, address, email, phone number and possibly your CC number, a prime target for identity thieves.
- kevincox 5y ago
  > even plain vanilla SMS based MFA is better than just a username and password for authentication I'd be careful with this because a lot of services will allow you to reset your password with just SMS verification once they have your number. So while Password+SMS is stronger in practice this usually becomes Password+SMS OR Customer Support+SMS which is decidedly weaker.
- BlueTemplar 5y ago
  It is very annoying how more and more shops force you to give a phone number... IMHO (unless product defect) only the transporter should get that !
  - Avamander 5y ago
    Twitch (Authy), eBay and Amazon come to mind as the most annoying examples. My god just give me TOTP or stop pestering me for my number. eBay is so idiotic that it even asks for security questions. The 2000s called, they want their obsolete security back.
sneeds 5y ago
> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Sorry, but this is no excuse. It has been 15 years and there were so many breaches that even many casual people know about databases leaks and that passwords have to be stored in some special way. I don't know this guy's background, but he at least knows that md5 is not sufficient here. And then it never crossed his mind to do a check up on this? That's just negligent.
- Markoff 5y ago
  to his defense it's not like there is anything serious stored there with those accounts, it's just subtitles
  - mnw21cam 5y ago
    It's not just subtitles - it's all the login information stored there as well. Email addresses to send spam to, passwords that have likely been reused on another site.
    - Markoff 5y ago
      and how is you reusing password to download subtitles (it ain't even necessary really) problem of the hacked site? yes spam could be annoying, but it's not like people use email only to register on one site
exotree 5y ago
I thought their response to this was very humble, and I wish them the best going forward.
AdmiralAsshat 5y ago
Meh. I treated that site like every random site that requires a login that I think I'll use once: it got my 20 year old Hotmail address, a randomly generated password, and was accessed solely from my VPN IP. The only reason I even set up an account was so that one of my Kodi extensions could hook into it.
- Jnr 5y ago
  I used it like a public site, using a very popular password. Same as in other sites where people share the same account between multiple people. I don't really mind that they got breached. I hope they recover easily and continue to offer their service. And I will not change that password, unless I am denied access. Don't really care if people know it.
  - genewitch 5y ago
    Open subtitles does require a pw change, it broke mplayer integration. Funny, though, they got breached approximately an hour after I went VIP - it's the only way to download an entire season of subtitles, and their maint window correlates to me having spotty subtitle coverage across most of my library. So I gave in and gave money. Then it's like "invalid password!"
jjice 5y ago
Tangentially related to this: Is storing passwords actually hard, or is it knowing know to do things like this that is? I've seen a lot of people on HN talk about how they never store passwords because they don't want the liability, and I've seen some talk about how they do since it's simple. In my experience, hashing with Argon2 and keeping that in the DB (for toy personal projects) has been very easy, especially to how scary keeping passwords seems to have been made. I guess my real question is: If I'm hashing with an actual password acceptable hash method (salt and all), is there any reason I shouldn't still do this? I'm legitimately interested, because for all I know, I'm experiencing the Dunning-Kruger effect.
- web007 5y ago
  Mostly A. Why bother with ever getting a password and having to deal with it in any way, versus delegating that aspect of security to a FAANG-level company with a > $1m security budget? You can store your password yourself, sure, but how certain are you that you're doing it "right" and that "right" today will be good enough tomorrow? 15 years ago MD5 wasn't perfect, but it was good enough versus the other common/stupid methods of storing the password directly or storing it encrypted vs hashed. How certain are you that Argon2 is going to stand the test of time for another couple decades?
foxtrottbravo 5y ago
Reading this makes me furious, not because they were hacked but because this shitshow of a Website was so damn lazy. (paraphrasing) "We were stupid 15 years ago and have been lazy ever since" is a slap to the face. Maybe they should have done something about their platform instead of watching anime with subtitles. Those people should have their internet privileges permanently removed and the whole site should be burned in a dumpster like the dumpsterfire of security they had running for fucking 15 years.
- foxtrottbravo 5y ago
  Adding insult to injury is the last Paragraph I actually missed: > If companies like microsoft, facebook, twitter, nintendo or zoom can get hacked, what are our chances as a tiny team to not endup getting attacked ? It's not about them getting attacked but they weren't the target of a three letter agency Throwing weaponized 0days their way either. Anything that is remotely considered best practice would have helped: Like having strong passwords for the "SuperAdmin" account that was compromised. It's called SuperAdmin for a reason don't you think? Not using unsalted hashes in the first place? Investing some of your ad revenue in making security updates to a system that was already bad the second it was conceived? Their whole statement is insulting
steviedotboston 5y ago
Not very reassuring that when you reset your password they send you a new one in plaintext over email....
sysadm1n 5y ago
Is there a database of subtitles besides Opensubtitles that we can use as a fallback? It would be great if there was a Github repo with a updated lists of .SRT files we can download at our leisure. Only caveats: - Github wouldn't like millions flocking to a repo to grab files. - I'm not sure sharing of subtitles fall under 'copyright violations'. It's a bit of a grey area. (it's just text right?!)
- sodality2 5y ago
  > (it's just text right?!) So are books unfortunately. I would really love if there was an open subtitle repo though. Hell I'd even help make it myself but xkcd/927 and whatnot.
- FabHK 5y ago
  There's a python "app" called subliminal (with a simple CLI) that handles the whole enchilada for you - identify the movie, contact several subtitle dbs to download the appropriate subtitles. Not sure how up-to-date it is kept, but for me it works reasonably well, except for obscure films. https://github.com/Diaoul/subliminal https://github.com/Diaoul/subliminal
- Markoff 5y ago
  I use opensusbtitles only through VLsub in VLC, if I have to go somewhere on my own (no susbs found on OS in VLC) I go to subscene
emptysongglass 5y ago
And this is why users protect themselves with services like Firefox Relay, something Dustin Ingram, a Python Software Foundation Director, doesn't appear to understand [1] or care. My email was leaked in this breach, along with many others, an email I used to really value but one I've since relegated to the dumpster fire of "spam slot" because I learned my lesson too late. Dustin has now locked that GitHub to only previous contributors so users are once again left voiceless and powerless in the continuing war against their privacy. We've been thinking of the business owners and the children [2] for decades now. It's time to start thinking of the users, people like you and me who are exploited constantly for everything they have to be unceremoniously discarded in a waste heap once they've been used up. [1] https://github.com/disposable-email-domains/disposable-email-domains/pull/298 https://github.com/disposable-email-domains/disposable-email... [2] https://news.ycombinator.com/item?id=29978952 https://news.ycombinator.com/item?id=29978952
- piechlediech 5y ago
  The blame belongs solely on opensubtitles.org for using a list to block users and getting hacked. They probably have their reasons but still I feel it is hostile to users that care about privacy. Firefox Relay is a disposable mail service, so it makes sense to include it in a list of such services. I wonder how they handle mail aliases like GMail allow with + or . as separators.
- darau1 5y ago
  Interesting. The service I use isn't there lol I'm afraid to tell anyone, now, lest it be put on the list.
- m-p-3 5y ago
  I tried modifying my email to a @mozmail.com on opensubtitles.org after the breach and I never received the confirmation email, so I assume they're blocking it. Anyway I deleted my account.
  - j1elo 5y ago
    Firefox Relay misses some emails due to misconfiguration of TLS. That might be the issue. This issue report is still open: https://github.com/mozilla/fx-private-relay/issues/757 https://github.com/mozilla/fx-private-relay/issues/757
m-p-3 5y ago
Alright, changed my password, and to mitigate the issue I tried switching the email to a disposable one (@mozmail.com) and never received the email confirmation to apply the change. Looks like I'll just delete my account and never come back then.
shaan7 5y ago
I already knew about this before I visited HN today, thanks to Firefox Monitor ( https://monitor.firefox.com/ https://monitor.firefox.com/ ) :D
eximius 5y ago
Bahaha I made an account a few days ago! So glad I used a throwaway email.
tlhunter 5y ago
> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Read as: In the last fifteen years we couldn't be bothered to fix our glaring security hole.
jcrawfordor 5y ago
I've lost a lot of trust in opensubtitles since they started going down for "scheduled maintenance" for about two hours a day during the west coast evening, started selling advertising in the middle of the subtitles, and launched a "2.0" in the form of opensubtitles.com that continues to have a confusing and poorly described relationship with opensubtitles.org. The whole thing has just given a solid impression of being poorly managed, and the way this breach notification is written really reinforces that. It's unfortunate as I would be happy to donate money but... not to opensubtitles, which seems to be too deep in a hole to realistically get back out of it.
kornhole 5y ago
This is another example of why we should use a unique email address and password for each account. If credit card is needed, use a virtual card. Otherwise one breach exposes our other accounts to compromise. anonaddy.com, simplelogin.com, and privacy.com are some of the services that help with this.
null4bl3 5y ago
Again! They just had a breach like 4 months ago
shudza 5y ago
Using md5 with no salt while providing paid services and obviously earning income, but in 15 years not even a basic security check? At this point, the web is becoming ridiculous, and stuff like this should be sanctioned.
southerntofu 5y ago
I love the concept of OpenSubtitles, but they seem to have a hard time maintaining centralized infrastructure. I don't really understand why downloads are zipped in 2022 when GZIP over HTTP is plenty efficient: maybe it's for backend storage space, though? Is there some way we could help OpenSubtitles decentralize and maintain a p2p or federated database of subtitles? This could probably prevent many modes of failure that have required to restrict access to the API over time.

279 points by aero-glide2 5y ago

> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Ouch! I hope they learned their lesson: Security is an ongoing effort.

ilogik 5y ago
for 2006 that's actually not bad. When I joined my first company in 2010, to my horror, they were using plain text passwords for users
- labster 5y ago
  My first company was using MySQL’s OLD_PASSWORD() function in 2013 — straight, with no salt or spice of any kind — in its 64-bit glory. Horrified, I did some research and threw bcrypt up there right away. Not sure if it was my my first commit, or the branch fixing 20 or so SQLIs was the first. I became my company’s software security expert out of sheer terror.
- BlueTemplar 5y ago
  Yeah, just last month I was shocked to see a shop where I forgot my 2017 password, to send it to me. in plain text. by e-mail. (at least IIRC they used HTTPS on their website !)
burai 5y ago
16 years without reviewing password security seems like a massive oversight. A major leak like this it's a high price to pay to learn this lesson.
- foxtrottbravo 5y ago
  The really bad thing is that md5 was considered broken in 2005 by security people like Bruce Schneier. To be fair to them it took till around 2008 for this to become widespread opinion but the signs were on the wall around 2004
  - GoblinSlayer 5y ago
    You believe sha256 would drastically improve password hashing, being a not broken hash function? In 2006 they likely ran php4 and didn't have much choice what hash to use.

PikachuEXE 5y ago

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

lillecarl 5y ago
I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use). BitWarden is open source, both server and clients. There's even a third party implementation of the server in rust that seems to be mostly compatible. Both the official and the third party server are self-hostable. BitWarden runs their infrastructure on Azure, uses Azure managed databases and Azure managed backups. So I'm quite comfortable having my passwords there. The only feature I miss is that I'd like BitWarden to send me an email with all my passwords, encrypted so that I own a backup of my data too in case the worst happens.
- toyg 5y ago
  > TOTP integrated into the password manager Is this portable, like Authy does it? Last time I moved phone it was a real pain to move authenticators...
  - lillecarl 5y ago
    Yes, you have the same TOTP keys in both your phone and browser ext
- diarrhea 5y ago
  > There's even a third party implementation of the server in rust that seems to be mostly compatible. Not just mostly. Vaultwarden also offers server-side features usually only found in paid Bitwarden plans.

throwaway834343 5y ago

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that would be amazing. Thanks HN

erklik 5y ago
> I can not believe the motivation can simply be to get subtitles to watch movies personally Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?
- szszrk 5y ago
  Well, not when licensed entertainment is involved. Subtitles may sound harmless but are enough to start a court battle. This happened in Poland with a similar site. I would not dare to claim that authors motives and all actions were clean and done in the open, but for sure they were targeted by various media groups for copyright infringement just because of plain subtitles. You need resources to deal with that and it's not gonna be a clean fight.
- lawtalkinghuman 5y ago
  > Does everything require a money motive? On HN, apparently. See the recent thread on Wordle. The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it. It is depressing that HN participants are so often mystified by the idea people might be motivated by intrinsic or social factors to engage in peer-based production (whether legal or not) when so many of the companies they run or work for exist only because of peer-based production efforts like Linux and other FOSS software.
  - throwaway834343 5y ago

gattilorenz 5y ago

> Tue Jan 18, 2022 2:34 pm > In August 2021 we received message on Telegram from a hacker, who showed us proof that he could gain access to the user table of opensubtitles.org, and downloaded a SQL dump from it. Wait, they got proof in August and release the info only now? Was this because they were trying to be in a talk with the hacker? It wasn't really clear, but it's a long time...

Deukhoofd 5y ago
They explain more here: https://forum.opensubtitles.org/viewtopic.php?p=46845#p46845 https://forum.opensubtitles.org/viewtopic.php?p=46845#p46845
- wasmitnetzen 5y ago
  So, still a wrong procedure. They should have told everyone to renew their password and view them as compromised in August. Edit: typo
  - gattilorenz 5y ago
    > nothing was leaked in august, we followed the hackers request, secured our services, hired an extra sysadmin, ran extra audits. Oh yes, what could ever go wrong with keeping already compromised passwords? Plus it was clearly a white hacker that helped them secure the website, the required fee was for this service. /s
    - aniforprez 5y ago
      It's truly appalling that so many times, on HN even, people genuinely recommend paying the ransom because "hackers won't go back on their word cause it'll ruin their reputation". If you're hacked, purge the passwords and reset everyone and do everything in your power to ensure no one can access it in a similar way again. I have no idea why anyone would think a hacker wouldn't simply turn around and sell the data anyway

franciscop 5y ago

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed passwords are rainbow tables). At least with salt+pepper it limits attack surface, but instead you should be hashing your passwords with: - `password_hash`[1] should be used instead of `hash_hmac`, with the algorithm being "PASSWORD_BCRYPT" or better[2]. This is a slow hashing method, meaning anyone trying to rainbow-table attack your passwords will have a hard time. - A common technique is not to delete old passwords, but instead to rehash them with the new algorithm. This would be useful for moving from sha256 => bcrypt, since collisions on sha256 are not practical, but if the original hash was md5 then I think it's fine to delete the md5 passwords and require a new one. Good luck to those who changed their email in 15 years though. [1] https://www.php.net/manual/en/function.password-hash.php https://www.php.net/manual/en/function.password-hash.php [2] I haven't followed the space too closely for 3-4 years, I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones

joren485 5y ago
> I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones While bcrypt is already much, much better than using MD5 or SHA256, the best practice is to use Argon2. In practice, it is more important to use a hashing algorithm that is designed for passwords (e.g. bcrypt, argon2, scrypt) than it is to choose the best one. As this breach shows, many sites are still using insecure hashes, like MD5, because it worked 15 years ago.
- brobinson 5y ago
  Which mode do you/would you use? Hybrid? I haven't had to write any password storage code since before Argon2 won the 2015 competition so I haven't gone deep on the "side channel attack vs. memory hardness" tradeoff question when picking the mode. I am curious which mode others are using.

stubish 5y ago

At one point I think you could use opensubtitles.org without a username and password. I wonder in hindsight if the liability of storing PII was worth it?

pizza234 5y ago
I think one use case was subtitle downloading (typically, a client like Subdownloader) for VPN users, whose requests would be denied if unauthenticated.
- pferde 5y ago
  Why? The site's raison d'etre is to make subtitles readily available for downloading by anyone. What is the purpose of locking it behind authentication? What did that realistically achieve?
  - drexlspivey 5y ago
    API REQUESTS MUST BE AUTHENTICATED With Covid-19 pandemic requests for our API went skyrocket, our servers could not handle so much traffic, so we decided to limit API usage just to authenticated requests for User Agents. In short it means, you have to provide opensubtitles.org username and password in LogIn() method. We are avare some of user agents doesn't implement authentication for numerous reasons. What you can do for fix, if your app is affected: - let your users know about this change - implement LogIn() into your app with user authentication - contact us for pricing, so your app can send unathenticated requests (e.g. if you have free and pro version of your app, it is possible free will work only with authenticated requests and pro works as before) More info on [our forum](https://forum.opensubtitles.org/viewtopic.php?f=11&t=17110 https://forum.opensubtitles.org/viewtopic.php?f=11&t=17110) We are actively blocking IPs, which are sending unathenticated requests
  - pizza234 5y ago
    Spam was one reason (I've actually asked to the admins, which were very pissed off by it).

theplumber 5y ago

Why do we learn that passwords are obsolate and webauthn is the only sane choice?

8organicbits 5y ago
I believe webauthn requires end users to perform key management. I suspect that is currently a harder task for the average user than a memorized or written-down password. Special hardware tokens may help, but I'm not sure how we'd convince average users to care or buy them. Are there any webauthn only sites, besides demos?
- nybble41 5y ago
  The end user's agent (browser) should handle the key management behind the scenes. Even without hardware tokens it's still at least as good as a software-based password manager. A Hierarchical Deterministic key system similar to the BIP32 scheme used by most Bitcoin wallets[0] would only require a single master private key per user to support any number of unrelated identities. That key could be generated from a master password, synced to each device through an enrollment process, or stored on a hardware token. [0] https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...
  - 8organicbits 5y ago
    This is new to me, thanks. Do you know how that supports use cases like if someone wants to change their flight from a hotel computer? I wouldn't want to expose a "master password" to a computer I didn't trust.
    - nybble41 5y ago
      If you don't trust the computer then your best option is a hardware token like the Trezor (which already supports WebAuthn in addition to its cryptocurrency functions). The better ones will include a screen where you can see details like which site you're signing into before confirming the request. Either way, the host computer never gets access to any private keys. It can still do whatever it wants with your login session on that site, though, so you'll want to be careful about logging in to sensitive sites from untrusted PCs. The same applies to password-based logins, of course; moreover, any password you've entered into a public PC should immediately be considered compromised and changed (from a secure device) at the earliest opportunity. Given any choice in the matter I would suggest using your own equipment to change the flight (e.g. a smartphone), even if it's less convenient.

johnchristopher 5y ago

Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surface for not much benefits to users (and probably themselves). edit: at the time I also was young and naive [0] and thought the open part of opensubtitles meant that people submitted subtitles in their free time out of their good heart and the site was simply hosting and organizing them, no problem with displaying ads on the website or at the beginning of the subs I thought, to make up for hosting costs. Subs hunting was so much fun at the time /s. But having to register to "prevent abuse" was a tad too much. [0] still am by the way, thanks for asking :)

mkdirp 5y ago
> Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). This was actually optional, and always was. I think the issue was that they had made some changes in the backend, but the addons didn't update the code to accommodate. At least this was the case for Kodi. The opensubtitles addon has essentially become abandonware anyway. There are now third-party addons that provide the same functionality but without a login, and across different subtitle websites.
- morrbo 5y ago
  Can you name a few please?
  - Liquix 5y ago
    https://github.com/a4k-openproject/a4kSubtitles https://github.com/a4k-openproject/a4kSubtitles anonymous, scrapes a handful of sites including opensubtitles + subscene
    - 5y ago

martin_a 5y ago

> It is kind of amazing, that the site was hacked now, after 15 years - so that hacker must have spent quite a lot of time and energy on it. I'm pretty sure that it did not take "that hacker" 15 years to find this vulnerability. Pretty strange forum post.

Aeolun 5y ago
Website still managed by a just graduated 21 year old?
- diarrhea 5y ago
  A prodigy at 6 years old back in the day.
  - Aeolun 5y ago
    Lol, I meant to imply the site changed owners over the years ;)
- Markoff 5y ago
  he is not that young, roughly my age around 40 living in Ko Phangan here are his videos since his website is dead and he is also not active on twitter anymore https://www.youtube.com/user/BranoGege/videos https://www.youtube.com/user/BranoGege/videos

iqanq 5y ago

>The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt That's a good excuse for it to be like this in 2006. What about 2021?

YPPH 5y ago

>On the technical side, he was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data. It can be tempting to forgo the same security considerations when programming backend applications which aren't ordinarily accessible to the public. I guess this is a reminder why the temptation must be resisted.

begueradj 5y ago

You did right: no need to pay the ransom.

baobabKoodaa 5y ago
I'm confused. Didn't he say that he DID pay the ransom?
- begueradj 5y ago
  My bad, you are right. He said they paid. The short history of ransomware shows whenever the ransom was paid, the attackers came back again to threat and solicit more money. It's advised not to pay. But only the business owners could have the right "feeling" as they are the only ones who communicated with the attacker(s)

morelish 5y ago

I wonder how the hacker got network access to the database? I couldn't work out from what I read. It said the DB had a weak superuser password. But it didn't say how the hacker managed to make network calls to the DB. Presumably there was some initial entry point to get inside the network? It sounds like maybe the web-application user verification was poor and the app allowed admin users to make arbitrary DB calls?

mustardo 5y ago
> was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data. Depending on the injection vulnerability data can be exfiltrated, there are tools like sqlmap https://sqlmap.org/ https://sqlmap.org/ which make it pretty easy to dump tables via injection
- morelish 5y ago
  Ah I see, it was the website user SuperAdmin the hacker got into. Cheers.
  - mustardo 5y ago
    Thats my understanding, I initially thought MySQL root user as well

gsich 5y ago

I recommend subscene.com for a no-hassle way to download subtitles.

Aissen 5y ago

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

stevewodil 5y ago
Slightly related, in order to prevent super long passwords from eating up CPU time is it better to hash using sha256 before argon/bcrypt so that the length is constant, or is it better to limit password length to some arbitrary number like 64 characters
- l-lousy 5y ago
  I think an average user password would be shorter than a sha256 hash no?
  - LeifCarrotson 5y ago
    Bcrypt truncates to 72 bytes, so it's kind of irrelevant IMO. Whether your average length is 12 or 20 or 64 bytes doesn't matter much. I expect the parent's concern came from experience with PBKDF2, where the length is unbounded. It's good to consider possible denial of service attacks: if someone submits an enormous 1 MB password a PBKDF2 hasher can be knocked offline for 60s. Sha256 will quickly crunch that attack to a more manageable length.
    - stevewodil 5y ago
      Exactly this, it’s a vector for DOS
- 8organicbits 5y ago
  > Many implementations of bcrypt truncate the password to the first 72 bytes, following the OpenBSD implementation. https://en.m.wikipedia.org/wiki/Bcrypt https://en.m.wikipedia.org/wiki/Bcrypt This sounds undesirable to me, so I'd support sha256 and an alternative. I'd also recommend adding a max password length to any API. No point in allowing million character passwords.

korginator 5y ago

By now I assume that any service where I've registered for an account is being actively targeted and that any organisation that's not a Google, Microsoft or the likes has already been breached. MFA is your friend, and even plain vanilla SMS based MFA is better than just a username and password for authentication. I've enabled hardware based MFA anywhere it's supported. 15-20 years ago it was fun to sign up for dozens of new services and we reused passwords everywhere. Now every one of these accounts is a liability and a potential vector for bad things to happen. The worst case scenario is when an account of yours is breached and abused for a long time, possibly with legal and financial ramifications, and you don't find out until much later. A couple of months ago I happened to glance at my Gmail's spam folder by chance, and one email way down the list immediately grabbed my attention. The subject line had *my password* for an old and unused account that I'd forgotten long back and the sender was trying to extort bitcoin if I wanted the account back. The big issue is with online shopping. The sender has your name, address, email, phone number and possibly your CC number, a prime target for identity thieves.

kevincox 5y ago
> even plain vanilla SMS based MFA is better than just a username and password for authentication I'd be careful with this because a lot of services will allow you to reset your password with just SMS verification once they have your number. So while Password+SMS is stronger in practice this usually becomes Password+SMS OR Customer Support+SMS which is decidedly weaker.
BlueTemplar 5y ago
It is very annoying how more and more shops force you to give a phone number... IMHO (unless product defect) only the transporter should get that !
- Avamander 5y ago
  Twitch (Authy), eBay and Amazon come to mind as the most annoying examples. My god just give me TOTP or stop pestering me for my number. eBay is so idiotic that it even asks for security questions. The 2000s called, they want their obsolete security back.

sneeds 5y ago

> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Sorry, but this is no excuse. It has been 15 years and there were so many breaches that even many casual people know about databases leaks and that passwords have to be stored in some special way. I don't know this guy's background, but he at least knows that md5 is not sufficient here. And then it never crossed his mind to do a check up on this? That's just negligent.

Markoff 5y ago
to his defense it's not like there is anything serious stored there with those accounts, it's just subtitles
- mnw21cam 5y ago
  It's not just subtitles - it's all the login information stored there as well. Email addresses to send spam to, passwords that have likely been reused on another site.
  - Markoff 5y ago
    and how is you reusing password to download subtitles (it ain't even necessary really) problem of the hacked site? yes spam could be annoying, but it's not like people use email only to register on one site

exotree 5y ago

I thought their response to this was very humble, and I wish them the best going forward.

AdmiralAsshat 5y ago

Meh. I treated that site like every random site that requires a login that I think I'll use once: it got my 20 year old Hotmail address, a randomly generated password, and was accessed solely from my VPN IP. The only reason I even set up an account was so that one of my Kodi extensions could hook into it.

Jnr 5y ago
I used it like a public site, using a very popular password. Same as in other sites where people share the same account between multiple people. I don't really mind that they got breached. I hope they recover easily and continue to offer their service. And I will not change that password, unless I am denied access. Don't really care if people know it.
- genewitch 5y ago
  Open subtitles does require a pw change, it broke mplayer integration. Funny, though, they got breached approximately an hour after I went VIP - it's the only way to download an entire season of subtitles, and their maint window correlates to me having spotty subtitle coverage across most of my library. So I gave in and gave money. Then it's like "invalid password!"

jjice 5y ago

Tangentially related to this: Is storing passwords actually hard, or is it knowing know to do things like this that is? I've seen a lot of people on HN talk about how they never store passwords because they don't want the liability, and I've seen some talk about how they do since it's simple. In my experience, hashing with Argon2 and keeping that in the DB (for toy personal projects) has been very easy, especially to how scary keeping passwords seems to have been made. I guess my real question is: If I'm hashing with an actual password acceptable hash method (salt and all), is there any reason I shouldn't still do this? I'm legitimately interested, because for all I know, I'm experiencing the Dunning-Kruger effect.

web007 5y ago
Mostly A. Why bother with ever getting a password and having to deal with it in any way, versus delegating that aspect of security to a FAANG-level company with a > $1m security budget? You can store your password yourself, sure, but how certain are you that you're doing it "right" and that "right" today will be good enough tomorrow? 15 years ago MD5 wasn't perfect, but it was good enough versus the other common/stupid methods of storing the password directly or storing it encrypted vs hashed. How certain are you that Argon2 is going to stand the test of time for another couple decades?

foxtrottbravo 5y ago

Reading this makes me furious, not because they were hacked but because this shitshow of a Website was so damn lazy. (paraphrasing) "We were stupid 15 years ago and have been lazy ever since" is a slap to the face. Maybe they should have done something about their platform instead of watching anime with subtitles. Those people should have their internet privileges permanently removed and the whole site should be burned in a dumpster like the dumpsterfire of security they had running for fucking 15 years.

foxtrottbravo 5y ago
Adding insult to injury is the last Paragraph I actually missed: > If companies like microsoft, facebook, twitter, nintendo or zoom can get hacked, what are our chances as a tiny team to not endup getting attacked ? It's not about them getting attacked but they weren't the target of a three letter agency Throwing weaponized 0days their way either. Anything that is remotely considered best practice would have helped: Like having strong passwords for the "SuperAdmin" account that was compromised. It's called SuperAdmin for a reason don't you think? Not using unsalted hashes in the first place? Investing some of your ad revenue in making security updates to a system that was already bad the second it was conceived? Their whole statement is insulting

steviedotboston 5y ago

Not very reassuring that when you reset your password they send you a new one in plaintext over email....

sysadm1n 5y ago

Is there a database of subtitles besides Opensubtitles that we can use as a fallback? It would be great if there was a Github repo with a updated lists of .SRT files we can download at our leisure. Only caveats: - Github wouldn't like millions flocking to a repo to grab files. - I'm not sure sharing of subtitles fall under 'copyright violations'. It's a bit of a grey area. (it's just text right?!)

sodality2 5y ago
> (it's just text right?!) So are books unfortunately. I would really love if there was an open subtitle repo though. Hell I'd even help make it myself but xkcd/927 and whatnot.
FabHK 5y ago
There's a python "app" called subliminal (with a simple CLI) that handles the whole enchilada for you - identify the movie, contact several subtitle dbs to download the appropriate subtitles. Not sure how up-to-date it is kept, but for me it works reasonably well, except for obscure films. https://github.com/Diaoul/subliminal https://github.com/Diaoul/subliminal
Markoff 5y ago
I use opensusbtitles only through VLsub in VLC, if I have to go somewhere on my own (no susbs found on OS in VLC) I go to subscene

emptysongglass 5y ago

And this is why users protect themselves with services like Firefox Relay, something Dustin Ingram, a Python Software Foundation Director, doesn't appear to understand [1] or care. My email was leaked in this breach, along with many others, an email I used to really value but one I've since relegated to the dumpster fire of "spam slot" because I learned my lesson too late. Dustin has now locked that GitHub to only previous contributors so users are once again left voiceless and powerless in the continuing war against their privacy. We've been thinking of the business owners and the children [2] for decades now. It's time to start thinking of the users, people like you and me who are exploited constantly for everything they have to be unceremoniously discarded in a waste heap once they've been used up. [1] https://github.com/disposable-email-domains/disposable-email-domains/pull/298 https://github.com/disposable-email-domains/disposable-email... [2] https://news.ycombinator.com/item?id=29978952 https://news.ycombinator.com/item?id=29978952

piechlediech 5y ago
The blame belongs solely on opensubtitles.org for using a list to block users and getting hacked. They probably have their reasons but still I feel it is hostile to users that care about privacy. Firefox Relay is a disposable mail service, so it makes sense to include it in a list of such services. I wonder how they handle mail aliases like GMail allow with + or . as separators.
darau1 5y ago
Interesting. The service I use isn't there lol I'm afraid to tell anyone, now, lest it be put on the list.
m-p-3 5y ago
I tried modifying my email to a @mozmail.com on opensubtitles.org after the breach and I never received the confirmation email, so I assume they're blocking it. Anyway I deleted my account.
- j1elo 5y ago
  Firefox Relay misses some emails due to misconfiguration of TLS. That might be the issue. This issue report is still open: https://github.com/mozilla/fx-private-relay/issues/757 https://github.com/mozilla/fx-private-relay/issues/757

m-p-3 5y ago

Alright, changed my password, and to mitigate the issue I tried switching the email to a disposable one (@mozmail.com) and never received the email confirmation to apply the change. Looks like I'll just delete my account and never come back then.

shaan7 5y ago

I already knew about this before I visited HN today, thanks to Firefox Monitor ( https://monitor.firefox.com/ https://monitor.firefox.com/ ) :D

eximius 5y ago

Bahaha I made an account a few days ago! So glad I used a throwaway email.

tlhunter 5y ago

> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Read as: In the last fifteen years we couldn't be bothered to fix our glaring security hole.

jcrawfordor 5y ago

I've lost a lot of trust in opensubtitles since they started going down for "scheduled maintenance" for about two hours a day during the west coast evening, started selling advertising in the middle of the subtitles, and launched a "2.0" in the form of opensubtitles.com that continues to have a confusing and poorly described relationship with opensubtitles.org. The whole thing has just given a solid impression of being poorly managed, and the way this breach notification is written really reinforces that. It's unfortunate as I would be happy to donate money but... not to opensubtitles, which seems to be too deep in a hole to realistically get back out of it.

kornhole 5y ago

This is another example of why we should use a unique email address and password for each account. If credit card is needed, use a virtual card. Otherwise one breach exposes our other accounts to compromise. anonaddy.com, simplelogin.com, and privacy.com are some of the services that help with this.

null4bl3 5y ago

Again! They just had a breach like 4 months ago

shudza 5y ago

Using md5 with no salt while providing paid services and obviously earning income, but in 15 years not even a basic security check? At this point, the web is becoming ridiculous, and stuff like this should be sanctioned.

southerntofu 5y ago

I love the concept of OpenSubtitles, but they seem to have a hard time maintaining centralized infrastructure. I don't really understand why downloads are zipped in 2022 when GZIP over HTTP is plenty efficient: maybe it's for backend storage space, though? Is there some way we could help OpenSubtitles decentralize and maintain a p2p or federated database of subtitles? This could probably prevent many modes of failure that have required to restrict access to the API over time.