11 ms·
Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
by jjacobson 15y ago
Zappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help.
- paulv 15y agoHow was the compromise discovered?
- jjacobson 15y agono clue
- palish 15y agoWas the password hash generated using bcrypt?
- jjacobson 15y agoPlaintext passwords never touch our database. Expiring everyone's passwords was a security precaution given the fact that our non financial customer data was compromised in the first place. I can't comment on what lib or algorithm we use to encrypt our passwords since I don't work on that team.
- ikor 15y agoHi. I'm customer outside of US and I received the email, went to site to reset my password and "We are so sorry – we are currently not accepting international traffic" - WTF? (sorry, but there is your logic?)
- jjacobson 15y agoInternational traffic will be re-enabled in the near future.
- MichaelApproved 15y agoWhy was international traffic disabled?
- jjacobson 15y agoJust a precaution while we asses and deal with this. Zappos doesn't ship internationally so we hope this isn't affecting many customers. But to those that are, we apologize. As soon as we can we'll re-enable traffic from outside the US.
- jjacobson 15y agoalso.... "assess" not "asses"
- lancewiggs 15y agoI for one would love Zappos to ship internationally, and your owners at Amazon already do. I know you can't comment, but please do what you can to push for selling to the other 6.7 billion of us.
- jjacobson 15y agoIt'd be cool if we could ship internationally. What would be even cooler is if we could inspire entrepeneurs in other countries to tackle it!
- lancewiggs 15y agotry http://fifty http://fifty one.com. They seem to be still growing, but facilitate international payments and shipping for a bunch of companies.
- tvaughan 15y agoI'm in Chile as part of Start-Up Chile. What exactly do you need? PS - I am also a US customer. A block on international traffic effects more than just international customers.
- gee_totes 15y agoGood job on the fast response! This is the first time I've heard about a security breach from a company before seeing the dump on pastebin
- draggnar 15y agoand to jump on social media to answer questions. the future of professionalism.
- joshuahedlund 15y agoAs a developer who fears these kinds of attacks on my own sites, is there anything you are able/allowed to reveal regarding how the attack happened, how it was discovered, and/or how it could be prevented?
- jjacobson 15y agoNot at this time. Sorry.
- deleted 15y ago[deleted]
- troll24601 15y agoDo you know what hash was used, if the passwords were salted and if so, if the salt is secure?
- jjacobson 15y agoI'm not on the team that handles passwords so can't comment. Sorry.
- dave1619 15y agoHmmm, please ask the team that handles passwords and let us know.
- manmal 15y agoWhat do you mean by "the salt is secure"? Hidden in code files vs. stored next to the hashed password?
- troll24601 15y agoI apologize if my question was unclear; that's almost certainly because of a lack of expertise on my side. On one end of the spectrum, I envision the same salt used for every user, allowing for the easy and effective creation of rainbow tables. On the other end, I envision unique salts with many bits of entropy for each user, making rainbow tables technologically infeasible.
- bestnameever 15y agoThe email did not mention order history. Do you know if our personal order history was among the items compromised?
- jjacobson 15y agoNot sure. Sorry.
- jjacobson 15y agoThere really is no good news in this type of situation, but only the data items mentioned by Tony in the email above were compromised.
- xp84 15y agoi'm picturing the blackmail note: "dear bestnameever, i know about those high heels you bought, and i happen to know you don't have a girlfriend. $1000 in unmarked bills or we tell your father you're a cross-dresser." Or the incredibly geeky wife who suspects her husband is showering the hot secretary with shoes and handbags, and confirms it by poring over the breached data.
- stickfigure 15y agoZappos developer here. I'll answer any questions that I legally can or help get customer problems passed onto people that can help. Can you provide any further information that would be of interest to HN readers? If not, why do you bother posting this?
- deleted 15y ago[deleted]
- andyfleming 15y agoBravo for being on top of things and answering questions on HN!
- newman314 15y agoGood job on not storing or sending clear text passwords. However, as others have indicated, we would like to know more about the hashing method used. As a side note, I was horrified to discover that Hertz sends passwords (as part of password recovery) in the clear. For those using Hertz, you should take the appropriate precautions.
- jjacobson 15y agoI'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. What are the best practices you want to see a website use when storing your password?
- cr4zy 15y agobcrypt http://en.wikipedia.org/wiki/Bcrypt http://en.wikipedia.org/wiki/Bcrypt
- manmal 15y ago+1 for bcrypt - "ordinary" hashing algorithms were made to compute as fast as they can, which is exactly the opposite of what you will want for your system. Rainbow tables are so quick and easy to make - IIRC it currently takes only some hours to compute all MD5 hashes for passwords up to 8 characters long on a system with some good graphic cards. What you want is an algorithm which takes an up-to-date system some 10-100ms to compute a hash - bcrypt is configurable in its complexity (time to compute hash), and you should adapt the parameters every 1-2 years to increase the complexity.
- newman314 15y agoSecurity through obscurity should not used. Just saying. IMO, revealing the method used should not become an issue just like the reason why the more trusted crypto algorithms are publicly posted. That said, bcrypt and a time/attempt limited lockout should go a good ways in securing your site.
- Deestan 15y ago> I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. The only way it could be harmful to disclose the hashing method is if you're using an insufficient one.
- brown9-2 15y agoWhat does it mean if you are a Zappos customer who did not get an email?
- jjacobson 15y agoAll Zappos customers will be receiving the email linked to in this thread. If you haven't it might be in your spam folder or it might still be queued to go out. The link above is the same as the email contents.
- statenjason 15y agoI don't seem to be receiving the password reset email. I do use an email with a plus ("foo+bar@example.com") if that has any effect.
- jjacobson 15y agoMost likely your password reset email is in the queue to go out. Emails are slow to go out due to the massive volume of outgoing email we are trying to send out.
- xp84 15y agoObviously in this kind of situation we (Zappos customers like myself) need to change any re-used passwords since the stolen unsalted hashes :( can be cracked. However, I have no idea which of several passwords I used at Zappos! I would normally just try logging in with each of them, but since you've reset all passwords, it looks like I won't be able to. Is there any chance of helping with this? I need to make sure it wasn't a password I use on any important sites (or derived from such a password). I'm looking for the data dump right now, in case it was posted publicly--that's probably the only way I'll be able to answer my question since I doubt Zappos will cooperate :( As someone who was just bit by the Stratfor data loss, this is the second month in a row. Fortunately my Stratfor password was worthless, but I had my credit card stolen and used to pay for video games. And now my email and street address are public information.