4 ms·

So, still a wrong procedure. They should have told everyone to renew their password and view them as compromised in August. Edit: typo

gattilorenz 5y ago
> nothing was leaked in august, we followed the hackers request, secured our services, hired an extra sysadmin, ran extra audits. Oh yes, what could ever go wrong with keeping already compromised passwords? Plus it was clearly a white hacker that helped them secure the website, the required fee was for this service. /s
- aniforprez 5y ago
  It's truly appalling that so many times, on HN even, people genuinely recommend paying the ransom because "hackers won't go back on their word cause it'll ruin their reputation". If you're hacked, purge the passwords and reset everyone and do everything in your power to ensure no one can access it in a similar way again. I have no idea why anyone would think a hacker wouldn't simply turn around and sell the data anyway
  - gattilorenz 5y ago
    I think people recommend that in case of ransomware, which is most of the time the only chance of getting the data back (helping the ransonware market thrive, and with the risk of not getting data back anyway). Never saw anyone suggest paying for avoiding password leaks
  - lbriner 5y ago
    I don't personally agree with paying the ransom but the logic seems sound. If you pay them, they might keep their word. After all, how much would they get paid for a list of passwords compared to a ransom payment? If you don't pay them, they are more likely to either sell or leak the lists. In this case, although easy to say now, the correct answer is not to create public web applications until you know how to store passwords correctly and host databases securely, it's not like the information isn't readily available.
    - npteljes 5y ago
      Well, they hacked the website in the first place, what do they have to lose? I'd say paying the ransom might get back you your files, and that's about it. They can still have a copy and do whatever.

gattilorenz 5y ago

> nothing was leaked in august, we followed the hackers request, secured our services, hired an extra sysadmin, ran extra audits. Oh yes, what could ever go wrong with keeping already compromised passwords? Plus it was clearly a white hacker that helped them secure the website, the required fee was for this service. /s

aniforprez 5y ago
It's truly appalling that so many times, on HN even, people genuinely recommend paying the ransom because "hackers won't go back on their word cause it'll ruin their reputation". If you're hacked, purge the passwords and reset everyone and do everything in your power to ensure no one can access it in a similar way again. I have no idea why anyone would think a hacker wouldn't simply turn around and sell the data anyway
- gattilorenz 5y ago
  I think people recommend that in case of ransomware, which is most of the time the only chance of getting the data back (helping the ransonware market thrive, and with the risk of not getting data back anyway). Never saw anyone suggest paying for avoiding password leaks
- lbriner 5y ago
  I don't personally agree with paying the ransom but the logic seems sound. If you pay them, they might keep their word. After all, how much would they get paid for a list of passwords compared to a ransom payment? If you don't pay them, they are more likely to either sell or leak the lists. In this case, although easy to say now, the correct answer is not to create public web applications until you know how to store passwords correctly and host databases securely, it's not like the information isn't readily available.
  - npteljes 5y ago
    Well, they hacked the website in the first place, what do they have to lose? I'd say paying the ransom might get back you your files, and that's about it. They can still have a copy and do whatever.