6 ms·

I'm concerned that this is happening so often that it is no longer raising eyebrows. It's becoming one of those "just how things work on the Internet, get used

I'm concerned that this is happening so often that it is no longer raising eyebrows. It's becoming one of those "just how things work on the Internet, get used to it".

revx 14y ago
Either that or 2-factor authentication will catch on and stealing passwords won't be worth anything.
- danielpal 14y ago
  Two-factor makes more sense. Relying on your database never getting hacked is nonsense. Is not a matter of are you getting hacked but when are you going to get hacked... expect getting hacked. (disclaimer: I am the founder of Authy.com a two-factor auth API)
- NelsonMinar 14y ago
  Blizzard has 2 factor; the secrets for the mobile authenticator seem to have been compromised as well as the hashed passwords.
  - jrockway 14y ago
    But secrets for the mobile authenticator are much less sensitive than passwords, which are prone to reuse. It does, however, defeat the security advantage of two-factor authentication. (I always thought the really smart crackers would break in, modify the application code to weaken the password encryption, and then re-encrypt every password when the user logs in. Come back a few weeks later and collect a bunch of working passwords, with nobody the wiser.)
Zenst 14y ago
I suspect the quality of Pen-Testing being carried out or lack of is certianly an area of concern given the frequency.
w1ntermute 14y ago
One of the many reasons using a password manager and having different, random passwords for each site is a good idea.
- dkokelley 14y ago
  I agree. As long as the password authentication mechanism is in place, unique, random, and complex passwords are the best way to secure yourself. Unless you can memorize each of these unique passwords yourself, the next best thing is to use a secure password manager program to take care of this for you.
  - MiguelHudnandez 14y ago
    I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get everything they needed. I would be in for a world of hurt! Way worse than if a few of my accounts were compromised because I had used the same password. But still, the chances of being compromised are probably much smaller.
    - DanBC 14y ago
      As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey). I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable. I'd also like a native, and trustworthy, password safe for OS X that can work with something like Yubikey.
      - BadassFractal 14y ago
        Is Yubikey superior to something like Keepass/Lastpass/1password?
        MiguelHudnandez 14y ago
citricsquid 14y ago
isn't it inevitable? Rogue employees, dumb mistakes, passwords will always be stolen: what's important is they're stored securely enough that when (not if) they are stolen they are worthless to the people that now hold the passwords.

I'm concerned that this is happening so often that it is no longer raising eyebrows. It's becoming one of those "just how things work on the Internet, get used to it".

revx 14y ago

Either that or 2-factor authentication will catch on and stealing passwords won't be worth anything.

danielpal 14y ago
Two-factor makes more sense. Relying on your database never getting hacked is nonsense. Is not a matter of are you getting hacked but when are you going to get hacked... expect getting hacked. (disclaimer: I am the founder of Authy.com a two-factor auth API)
NelsonMinar 14y ago
Blizzard has 2 factor; the secrets for the mobile authenticator seem to have been compromised as well as the hashed passwords.
- jrockway 14y ago
  But secrets for the mobile authenticator are much less sensitive than passwords, which are prone to reuse. It does, however, defeat the security advantage of two-factor authentication. (I always thought the really smart crackers would break in, modify the application code to weaken the password encryption, and then re-encrypt every password when the user logs in. Come back a few weeks later and collect a bunch of working passwords, with nobody the wiser.)

Zenst 14y ago

I suspect the quality of Pen-Testing being carried out or lack of is certianly an area of concern given the frequency.

w1ntermute 14y ago

One of the many reasons using a password manager and having different, random passwords for each site is a good idea.

dkokelley 14y ago
I agree. As long as the password authentication mechanism is in place, unique, random, and complex passwords are the best way to secure yourself. Unless you can memorize each of these unique passwords yourself, the next best thing is to use a secure password manager program to take care of this for you.
- MiguelHudnandez 14y ago
  I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get everything they needed. I would be in for a world of hurt! Way worse than if a few of my accounts were compromised because I had used the same password. But still, the chances of being compromised are probably much smaller.
  - DanBC 14y ago
    As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey). I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable. I'd also like a native, and trustworthy, password safe for OS X that can work with something like Yubikey.
    - BadassFractal 14y ago
      Is Yubikey superior to something like Keepass/Lastpass/1password?
      - MiguelHudnandez 14y ago

citricsquid 14y ago

isn't it inevitable? Rogue employees, dumb mistakes, passwords will always be stolen: what's important is they're stored securely enough that when (not if) they are stolen they are worthless to the people that now hold the passwords.