6 ms·

These details are befuddling. "Personal information was encrypted and cannot be accessed". It can't be accessed because it's somehow stored elsewhere, or it can

by tsm 13y ago

These details are befuddling. "Personal information was encrypted and cannot be accessed". It can't be accessed because it's somehow stored elsewhere, or it can't be accessed because of the encryption? That is, does the intruder currently own my encrypted data? I'm also disappointed that it took them 72 hours to tell us anything, and that the update doesn't even have a timeline for when the site may be back. "Soon" is meaningless.

tlongren 13y ago
As I interpreted it, yes, the intruder does have your encrypted data.
- deleted 13y ago
  [deleted]
- num3ric 13y ago
  I hope you were using good encryption Apple. This guy cracked 400,000 md5 hashed passwords: http://www.youtube.com/watch?v=0WPny7wk960 http://www.youtube.com/watch?v=0WPny7wk960 He says even with password salts, it could be done.
  - ptwiggens 13y ago
    Unsalted MD5 has been extremely easy to crack for years. Not sure why the claim would be impressive at this point.
  - laumars 13y ago
    To be fair, unsalted md5 hashes are only one step above storing passwords in plain text.
  - MrGando 13y ago
    I could crack your unsalted md5 password with my Gameboy Color.
Watabou 13y ago
Yeah I'm confused why companies tells us DAYS after something serious happened as opposed to right away. I can understand waiting a day but 3 whole days?! I just don't understand the delay. It's our data, we should have the right to know what happened to it.
- badclient 13y ago
  It can take more than a day to know what happened to your data.
  - lambda 13y ago
    Yes, but it doesn't take more than a day to know that an intruder had accessed the system in a way that may have compromised your personal information. Basically, once the problem was serious enough that they felt like they needed to take the site down, I'm pretty sure they knew which machines had been accessed (or at least may have been accessed). They knew that some of those machines had developer's personal information. They could have posted as much up front, rather than waiting 3 days to do so.
    - ptwiggens 13y ago
      "I'm pretty sure." No, they likely took the portal down as soon as they knew there was a breach. Highly unlikely they left it up while they investigated, and it takes time to figure out what happened and how much information was taken. What motivation would there be to wait anyways?
      - lambda 13y ago
        > No, they likely took the portal down as soon as they knew there was a breach. Highly unlikely they left it up while they investigated, and it takes time to figure out what happened and how much information was taken. They still haven't said anything about how much had been taken. My point is they knew how much could have been taken. They knew what machines were at risk; hence taking them down. If those machines that were at risk had sensitive personal information, they should have notified the people affected right away, not three days later. Taking the site down, with no indication of why, and waiting three days to tell people that their personal information may be at risk (and remember, the possibly compromised information includes credit card numbers, as there are a number of things you need to pay for in your developer account) is just crazy. You should be upfront and transparent when the breach first occurs. Of course you don't know exactly what has been compromised; but they are still being plenty vague even three days later. If they had posted three days ago what they posted today, it would be a lot more reassuring.
ajasmin 13y ago
Apple should have kept us informed from day one. But, in their defense it may take days to ascertain what exactly happened. Once a system is compromised it's nearly impossible to trust anything about it. Auditing the logs, and reviewing the code, crypto, and the mix of platforms they're using (see https://news.ycombinator.com/item?id=6078854 https://news.ycombinator.com/item?id=6078854) in order to understand what data could be accessed and fix all vulnerabilities is not an easy task. The PlayStation store was not down for such a long time without reason.

by tsm 13y ago

tlongren 13y ago

As I interpreted it, yes, the intruder does have your encrypted data.

deleted 13y ago
[deleted]
num3ric 13y ago
I hope you were using good encryption Apple. This guy cracked 400,000 md5 hashed passwords: http://www.youtube.com/watch?v=0WPny7wk960 http://www.youtube.com/watch?v=0WPny7wk960 He says even with password salts, it could be done.
- ptwiggens 13y ago
  Unsalted MD5 has been extremely easy to crack for years. Not sure why the claim would be impressive at this point.
- laumars 13y ago
  To be fair, unsalted md5 hashes are only one step above storing passwords in plain text.
- MrGando 13y ago
  I could crack your unsalted md5 password with my Gameboy Color.

Watabou 13y ago

Yeah I'm confused why companies tells us DAYS after something serious happened as opposed to right away. I can understand waiting a day but 3 whole days?! I just don't understand the delay. It's our data, we should have the right to know what happened to it.

badclient 13y ago
It can take more than a day to know what happened to your data.
- lambda 13y ago
  Yes, but it doesn't take more than a day to know that an intruder had accessed the system in a way that may have compromised your personal information. Basically, once the problem was serious enough that they felt like they needed to take the site down, I'm pretty sure they knew which machines had been accessed (or at least may have been accessed). They knew that some of those machines had developer's personal information. They could have posted as much up front, rather than waiting 3 days to do so.
  - ptwiggens 13y ago
    "I'm pretty sure." No, they likely took the portal down as soon as they knew there was a breach. Highly unlikely they left it up while they investigated, and it takes time to figure out what happened and how much information was taken. What motivation would there be to wait anyways?
    - lambda 13y ago
      > No, they likely took the portal down as soon as they knew there was a breach. Highly unlikely they left it up while they investigated, and it takes time to figure out what happened and how much information was taken. They still haven't said anything about how much had been taken. My point is they knew how much could have been taken. They knew what machines were at risk; hence taking them down. If those machines that were at risk had sensitive personal information, they should have notified the people affected right away, not three days later. Taking the site down, with no indication of why, and waiting three days to tell people that their personal information may be at risk (and remember, the possibly compromised information includes credit card numbers, as there are a number of things you need to pay for in your developer account) is just crazy. You should be upfront and transparent when the breach first occurs. Of course you don't know exactly what has been compromised; but they are still being plenty vague even three days later. If they had posted three days ago what they posted today, it would be a lot more reassuring.

ajasmin 13y ago

Apple should have kept us informed from day one. But, in their defense it may take days to ascertain what exactly happened. Once a system is compromised it's nearly impossible to trust anything about it. Auditing the logs, and reviewing the code, crypto, and the mix of platforms they're using (see https://news.ycombinator.com/item?id=6078854 https://news.ycombinator.com/item?id=6078854) in order to understand what data could be accessed and fix all vulnerabilities is not an easy task. The PlayStation store was not down for such a long time without reason.