9 ms·
YouPorn passwords available for download, thousands of users exposed
- pjscott 15y agoHow many sites need to be humiliated like this before people learn to hash passwords with something like bcrypt? It's like two damn functions. You just call them! It's so easy that even a baby squirrel could do it! There is no excuse. Until then, I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones.
- noobface 15y agoIt'll just take one congressman's e-mail password to be the same as his YouPorn password, then it'll be law to encrypt.
- uxp 15y agoBased entirely on the format of the data that was publicly accessible, it looks like this data, including usernames and passwords, are raw $_POST server variables spit out in a debug log. All the hashing and encryption in the world can't protect you against saving the data to disk, above your webroot, in plain text before you hit your security component. This was pure programmer error, a form of ignorance, but not necessarily a sign of incompetence.
- pjscott 15y agoMy point still stands in general, though apparently not in this particular case. :-) Nice catch, by the way.
- pbreit 15y agoBesides "use bcrypt" I've never really seen decent guidance on how to actually store passwords (what sort of salt to use, where to store the salt, if and where to store the hash method, how/where to store the key, etc).
- Cushman 15y ago"Use bcrypt" is the answer to all those things. Bcrypt includes a salt, which is stored along with the method in the hash string. Hashing is not the same as encryption, so there is no key involved.
- ars 15y agoIf you are using PHP then do this: $salt = '$2a$08$' . $random_data; $hash = crypt($password, $salt); $random_data is 22 random letters from A-Za-z0-9.= (16.5 bytes) (08 is the cost factor - you can change it, but 8 seemed reasonable in my tests.) If you google bcrypt and php you'll find a very complex and large class for doing this. It's no longer necessary - current versions of PHP have it built in.
- brodd 15y agoMarco Arment (marco.org) has written a nice wrapper for it. https://gist.github.com/1053158 https://gist.github.com/1053158
- pjscott 15y agoI'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same. When a user gives you their password for the first time, here's what you store in your database: hashed_password = bcrypt.hashpw(password, bcrypt.gensalt()) Store hashed_password in your database for later. Then, when a user tries to log in, they will tell you their password. You'll need to check that it matches the hashed_password value you have stored. Here's how: if bcrypt.hashpw(password, hashed_password) == hashed_password: print 'Password is correct!' else: print 'Wrong password.' That's all there is to it. The bcrypt library handles everything else. It is this simple because if it weren't, people would mess it up.
- drivebyacct2 15y ago> I hope everyone is using a throwaway password for accounts that can be non-disastrously stolen, and using strong unique passwords for the important ones. Why even bother with the distinction. Use a unique password for every login. Use something to manage your passwords. If someone is unwilling to generate a password for an unimportant site, they're probably also too lazy to properly generate unique passwords for sites that matter.
- ppod 15y ago>hash passwords with something like bcrypt? It's like two damn functions. You just call them! I estimate that the average web user understands about 66% of those words. And that's if we give them 'password'.
- devicenull 15y agoOkay, let's say you have to integrate with a third party product that can only deal with passwords in normal crypt(). What do you do then? (Rewrite third party product is not a valid answer). What if you're integrating with something like a Windows VPN w/RADIUS, which needs the plaintext password? Bcrypt, while trivial for many applications, is not the answer to everything.
- laconian 15y agoKudos on the double entendre in the title, intentional or not.
- verelo 15y agoim so glad you noticed this, because it got me laughing but i couldnt decide if it was on purpose or not either! A good joke on words makes the world a better place.
- aes 15y agoI was thrilled on the self-describing appropriateness of the term "double entendre" in this context until I found that "entendre" didn't actually mean "enter" in French. If it would, the term itself would be hilarious.
- rdl 15y agoI'm kind of surprised it wasn't taken deeper, like "penetration at adult site youporn leaves vulnerable users gaping and exposed".
- rokhayakebe 15y agoWhy would anyone sign up for a porn site with their main email address? What baffles me even more is how some people actually whip out their credit card and give the digits to a porn site.
- jrockway 15y agoWhat baffles me even more is how some people actually whip out their credit card and give the digits to a porn site. Why? Most of the big porn studios are as trustworthy as any other Internet business of the same size, and if your credit card number is misused, you're not liable for the charges anyway. Porn popularized selling DRM-free content for money long before Louis CK made it popular. Porn actors need to pay their rent too.
- spindritf 15y ago> Why? Most of the big porn studios are as trustworthy as any other Internet business of the same size The probability of a leak may be similar but the downside isn't. It's no problem whatsoever if your name is linked to cheapprogrammingbooks.com, you cancel the card, get a new one. The situation is somewhat different for spermgarglingteens.com.
- jrockway 15y agoHow? Someone that regularly peruses leaked password lists will know that you look at porn?
- ahel 15y agohttp://pastebin.com/yJ8JU45W http://pastebin.com/yJ8JU45W
- te_chris 15y agoAnd all this after all the press about them moving their entire stack to Redis etc etc. How can a company achieve such an epic technical feat and have shitty password hashing?
- cstejerean 15y agoThis doesn't look like a problem with password hashing. This is what happens when you get careless with debug logging.
- joejohnson 15y agoLink to the password dump: http://pastebin.com/ieC6eTB7 http://pastebin.com/ieC6eTB7
- tansey 15y agoAny link to the password dump from the Brazzers attack referenced in the article?
- Kiro 15y agoEverything was on http://chat.youporn.com/tmp/ http://chat.youporn.com/tmp/ completely open to the public so this is an even bigger screw-up than the fact that they didn't hash their passwords.
- mycodebreaks 15y agoHow do passwords get leaked? Does it mean they were stored in plain text?
- paul9290 15y agoAlways good to have a throwaway email, username and password for sites like this and others you care little about.
- simcop2387 15y agoI've always used mailinator for this. Makes a great site for that kind of thing.
- uvTwitch 15y agoYouPorn: where everything is exposed.
- verelo 15y agoso who is going to be the first person to parse this out and determine what the most commonly used password is? Any bets on asdfghjkl;' ?? i think i'll do this tonight
- daniellockard 15y agoit's 123456, and that's pretty common across a lot of sites.
- theirixhn 15y agoUnfortunately there are only 4800 unique users of total 6000 in pastie, a lot of dups. So recent arstechnica statistics, especially tag cloud by Ashkan Soltani, is not very accurate. It was very strange to discover generated '3kpm1858' password as popular. Check it here http://pastebin.com/f7MUMw6t http://pastebin.com/f7MUMw6t
- jamesu 15y agoThis has been passed around a certain anonymous messageboard for the better part of a week now, i'm surprised sophos has taken this long to write anything about it!
- ___Calv_Dee___ 15y agoI don't understand how this makes it to Top News. I think at this point we are all well aware that no user-password store is impenetrable or invulnerable and porn websites would hardly be an exception. If you do not know by now that you should not be using the same password across multiple accounts, it seems like there is little hope. There is no lesson to be learned here. Is it not an implicit assumption that if you subscribe to a porn website someone is mostly likely going to find out one way or another? 1. Don't reuse passwords. 2. Don't subscribe to porn sites if you have something to lose from someone finding out.
- jarin 15y agoI think it is more of a public service announcement, because it is a very popular site and yes, a lot of people on HN probably use it.
- aaronpk 15y agoSomeone should make a site where you sign in with your Gmail account and find out how many of your contacts have youporn accounts.
- rsanchez1 15y agoI wouldn't trust a site like that with my Gmail contacts.
- aaronpk 15y agoThat was kind of part of the irony :)
- ortatherox 15y agowith google's oauth you wouldn't have to give them access to your account ;)
- rdl 15y agohttp://blog.youporn.com/youporn-data-not-exposed/ http://blog.youporn.com/youporn-data-not-exposed/ It was actually the passwords to YP Chat, not Youporn itself. The Yourporn guys are pretty reasonable engineers and sysadmins, from what I've seen, and manage user passwords correctly. Personally, I think in 2012, if you're not using a password manager to generate and manage unique, strong passwords per site, especially for "sketchy" stuff like porn sites, you're already doomed. Also, Presidents Day and other minor useless holidays are great times for annual rituals like tracking down and changing any legacy shared passwords you may have. Don't wait for a breach!
- drivebyacct2 15y agoThe sad thing is, people don't use password managers out of laziness despite the fact that it actually speeds up all of these processes. One password unlocks it, one click to login to any of my sites with strong, secure, unique passwords. Autofills out registration forms and generates a unique password for me. It's faster than me having one memorized password. Yet, friends and HN hackers alike have scoffed at my attitude which is roughly the same as yours. If you're blindly trusting sites with a non-unique password, it's only a matter of time. (edit) To get ahead of the repeat replies, LastPass syncs across browser extensions, encrypt/decrypts locally, can be accessed from any browser even without an extension and has mobile apps. I've been using it for probably two years now and I've never not been able to access an account even when using all varieties of guest computers, iPads, etc.
- phamilton 15y agoI don't use a password manager because I don't always use the same computer. As a student I use a number of different machines on campus. A password manager would be extremely inconvenient. I do, however, use a simple templated password. By including a few unique characters (following an easy to remember formula from the sites domain name) in an already strong base password, I can use dozens of unique passwords without any special environment.
- drivebyacct2 15y ago
- shadowed 15y agoBonus: it appears YouPorn has no way to change your password, nor any way to change (or even see) the email address that is associated with your account.
- pstatho 15y agoI'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably that some have re-used the same username password combination that is highly unrecommended for all you folks out there (if you read Hacker News, you already know that). As for password policies, I've been enforcing hashing of passwords ever since joining, though as we inherit a lot of old code and sites we correct issues such as that as we come across them. I'll be around for a while, if anyone wants to ask questions.
- rhizome 15y agoSomething about that URL tells me you didn't always mind if people associated the two together.
- pstatho 15y agoI suppose at some point the old owners did want to make that association. That deal was in place since 2008, we've been managing it for less than a year now. We've been focusing on the rewrite of the main site and are now cleaning up all the secondary dependencies.
- rhizome 15y agoNothing personal, but is there something about the industry that causes you to be evasive and use weasel words? It doesn't seem controversial that giving a company a subdomain on your site implies an associative connection, not just "I suppose..." SRS Q.
- HNatWORK 15y agoIt should be trivial to determine which accounts have the same passwords, are you taking any proactive steps to help secure these accounts?
- NelsonMinar 15y agoTop 10 domains: 1469 yahoo.com / 1071 hotmail.com / 882 gmail.com / 205 hotmail.co.uk / 178 web.de / 136 gmx.de / 127 aol.com / 116 hotmail.de / 115 live.com / 104 hotmail.fr Top 10 passwords: 110 123456 / 75 123456789 / 30 12345 / 23 melinda / 19 fuck / 18 1234567890 / 17 Nightmare / 16 allzen / 15 password / 15 anal That's of about 6400 records.
- pyre 15y agoI'm curious about these: 23 melinda 16 allzen Seems odd that so many people would end up with those passwords. Maybe these represent multiple accounts by the same person?
- NelsonMinar 15y agoYou're right, it's mostly just a few people. There are duplicate entries in the input file I didn't account for.