10 ms·
Hack of Cupid Media dating website exposes 42 million plaintext passwords
- ibsathish 13y agoStill in web 0.0 storing passwords in plain text? Awful.
- MattBearman 13y agoI can't get my head around how this still happens. I few years back I took over development of an old PHP website, which had a horrible code base (no framework or library, not even MVC). This site had around 30,000 users, all with plain text passwords. It took me all of a couple of hours to get the site using bcrypt. I'm not saying I'm some kind of super-rock-ninja-star developer, just that this is so easy to fix, even on monstrosity, legacy code bases. There really is no excuse.
- mattmanser 13y agoBecause of this: If a site is using plaintext password often the owner asked for it. They wanted their users to be able to recover their passwords. And the dev didn't understand why this was a bad idea. They need to be educated, convinced and then convinced that the time you're about to spend on fixing this is more important than the 101 other things going wrong because the original dev wasn't very good. And isn't actually causing a single problem right now. That also means that the password recovery function uses this code. Maybe there's an auto-user generator when you sign up for the newsletter. The email system obviously also uses that code. That also sometimes even means the password is stored twice, once in the framework's user mgmt tables and once in a user or person or the tblPRSN_UPDATED_OPTIMIZED_mc table. And just deleting that column might cause all sorts of other problems. Setting it null might cause bugs. Setting it empty string might cause a massive security hole as there's a login mechanism you haven't even found yet. (remember the dropbox breach?) It's never a 3 hour job to fix unless you're very bad at estimating, are working on something extremely trivial or do a half-ass job, potentially introducing a far worse security hole.
- jiggy2011 13y agoIt's quite possible the dev knew it was a bad idea and maybe even argued against it but was told to implement it this way anyway. The problem a dating site probably has is people who sign up accounts and then stop using them. They want to send these users reminder emails in the hope that some of them re-engage. Problem is that some of these users have probably forgotten which password they use for that website, and some % of those will not bother using the password reset mechanism. So someone in marketing has the bright idea of sending emails that include the username/password combo, the dev explains why this is a terrible idea and then gets overruled.
- relix 13y agoI include an "Instant Login" link in each mail so the users don't need to remember their password. It contains a unique time-sensitive token to identify the user and instantly sign them in (much like a password reset). I learned this technique from OKCupid, so no idea why they still had plaintext passwords.
- jiggy2011 13y agoMaybe simply emailing the password still has a higher conversion rate than the one time link, for example if the user does not see or understand the link or perhaps they want to login later when their email is not open. It can be difficult to argue for security in cases where even small % of short term revenue might be affected.
- mortehu 13y agoIt turns out Cupid Media is unrelated to OkCupid.
- mcgwiz 13y agoI hope you educated your users not to forward any of that mail.
- kawsper 13y agoAfter how much time will the token expire?
- ohwp 13y agoWell they were lucky you fixed it. There are loads of sites built year ago that just work so nobody is looking into the code base ever.
- wikwocket 13y agoSure, it's not hard to use bcrypt for passwords. It's also not hard to make your login forms use https, or to do weekly backups, or to use source control, or to keep Wordpress up to date. Yet many many websites/apps/companies do not get these right. The barrier is not difficulty. The barriers are lack of time to spend on infrastructure/security improvements, lack of motivation, and distraction due to new feature requests. Of course forgoing these things will bite you in the end, but this is the internet age; people don't tend to plan that far in advance.
- mfkp 13y agoHad to look it up - unrelated to okcupid. For those interested, here's a list of their web properties: http://www.cupidmedia.com/services.cfm http://www.cupidmedia.com/services.cfm
- onion2k 13y agoIronically, one of their sites is "OnlineDatingSafetyTips.com".
- matthuggins 13y agoPretty sure it's not ironic since dating safety != system security.
- nyrina 13y agoI don't think that is the kind of safety they are talking about
- jaynos 13y agoTwo thoughts: 1. Thanks for the tip. I came to commetns mainly to see if I needed to change my okcupid password. 2. There are a lot of specialty dating sites out there.
- jwcrux 13y ago> .cfm Looks like coldfusion to me, which has had a host of vulnerabilities pop-up in the past couple years. Wouldn't be surprised if that was an easy entry point.
- stfu 13y agoJust a random question: Is there anything that gives companies incentive to prevent such hacks? It seems that there is no consequences at all, except for some loss of reputation in tech community. Is there a way to put legal pressure on tightening up security?
- mogrim 13y agoThat's pretty much country dependent, local legislation on data protection varies. (And even then AFAIK is limited to sensitive data, such as race/religion/banking, not the password to some website...)
- l0gicpath 13y agoYou are looking at necessity products built by large corporations whose products are usually regarded as the best of breed in the market. If you are a designer for instance, you'll most likely come to depend on Adobe Photoshop. That means at some point you've created an account. Adobe got breached and your data got leaked, you'll likely whine a little about it online but unless you are willing to: - shift your work and relearn a new tool than Photoshop - navigate your way around closing your account (with the assumption that your data is actually deleted after account closure) which is rather hard in most cases, no one likes losing users. Then you'll likely just suck it up, do what you can and hope for the best. On the other hand, you got small time (but growing - not web-scale yet-) services/products that can't really afford losing a large number of users. Those would worry most about security. Ironically, they'd stay off the grid for long enough and wont become attack targets until they make it big. But that's just really the security industry, no system is 100% secure. And you never know if you've tightened your security enough until someone drills a hole. Then you patch it. Any self respecting corporate will have a security auditing policy. The so called white-hat hackers or pen-testers. Good companies will run security audits every now and then in hope to discover new security holes introduced by software updates, system policy changes...etc. As for legal pressure, it depends on what we are talking about. If you are a payment processing company then any data breach is a violation of your PCI compliance, which leads to a lot of bad PR and legal consequences. If Facebook got breached and data was exposed, I doubt there is anything in the law that reacts to such issue. Unless someone sues Facebook for damages, then that's a whole different ball game. The incentives are there for any business of all sizes. Legally? It depends. It's those schmucks that screw us all, plaintext passwords and shit. Edit: Fixed formatting.
- markdown 13y agoThis is getting ridiculous. When are we going to see legislation enacted to take these people to task? Surely there is a case to be made that their negligence causes (or has the potential to cause) real harm to their users. We need a Saul Goodman to put together a class action.
- camus2 13y ago> When are we going to see legislation enacted to take these people to task? And how would you enforce this ? mandated paid audits provided by companies that have lobbyists and friends in Washington ? Enough with the laws, laws are not an answer to every problems. If there is harm , let the users sue, but stop with your laws...
- bruceboughton 13y agoPro-active enforcement is not always necessary. The possibility of a large fine if found in breach of the law is usually enough for responsible companies to take the matter seriously. Of course, you also need guidelines for implementation.
- markdown 13y ago> And how would you enforce this ? ... mandated paid audits No, that would be quite silly and wouldn't work. It could simply be reactive rather than proactive. When an incident occurs where sensitive user data is exposed, simply launch an investigation into whether there were "adequate" protections in place. If it is found that sensitive data was stored unencrypted, for example, put the directors of the company behind bars for negligence. I'm dreaming of course. Steal a loaf of bread, life in jail without parole. Expose the private data of millions... have a strong whisky, put out a press release, head to the golf course.
- sdoering 13y agoEven more simpler: If "adequate" protections are missing: Pay every breached user $10. That way such a breach gets a hefty price-tag and devs/PMs could argue with management, that it is economically feasible to implement these measures. I know of a PM, that tells devs, that report security-problems inside his product, that they should not care, but instead finish "that news shiny little thing" and that that is their job in his opinion, not detect some strange security-problem.
- nly 13y agoBefore the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing. Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide: https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco... The sooner we stop pretending there are no better answers than sending the contents of a password field raw over the wire, over SSL or not, and the sooner the web browser vendors and W3C start fixing this, the better. TLS-SRP is a ray of hope, but we need lighter, easier to deploy solutions that work at the application level rather than below HTTP. On what alternate reality are we living where the W3C are working on Javascript cryptography before improving basic, fundamental, built-in authentication?
- facorreia 13y agoI agree, trusting remote services (and the communication infrastructure in between) is naïve. Meanwhile, I use KeePass and generate a different key for each service.
- nly 13y agoI also use Keepass....but why the smeg do I need to do this? My browser should be deriving per-site passwords for me at a minimum
- Zombieball 13y agoLastPass has browser plugins that do this. Edit: Additionally LastPass supports login to your LastPass account via password + OTP combination such as Google Authenticator and Yubikeys.
- NateDad 13y agoLastPass is awesome.
- SilkRoadie 13y agoWhat gets me is that security professionals keep talking about layers of security. I don't understand how many recent attacks have resulted in complete breaches. Adobe had source code taken, vB gave over pretty much complete server access. You now have Cupid Media not even hashing passwords. The final defense of user information ignored.. It took me 3 days to implement password security on a legacy system. Implemented password strength requirements. Users trying to sign in with weak passwords were flagged and forced to change their password to meet new requirements. Plain text passwords were hashed with bcrypt. One guy.. 3 days. The UK has ICO. I would like to see these getting involved in cases like this. Where they can fine websites catering to UK users who show negligence when storing user information. If it is not currently within their powers I would like to see a law change. There should be more accountability for website owners. http://www.ico.org.uk/ http://www.ico.org.uk/
- 16s 13y agoOften times, the hack is through a web front-end. Back-end systems (such as DBs) are heavily firewalled, logged, monitored, etc. and are generally very well protected. Systems guys (OS and DB) know security pretty well and have been doing it for a long time now. Much of the web software that powers the front-end is complex (PHP, Java, .Net, JS, CSS, SQL, includes, 3rd-party libraries from everywhere, etc). That complexity has a broad attack surface that is difficult and time consuming to test. And many devs are late to the security party (unless we're talking OpenBSD developers). Management wants to push out new features by X date. Devs have very little time to test and are behind on security anyway. Hackers have all the time in the world to poke at the web front-end and test every possible combination of things until they finally get in. In a nut-shell, that's the problem as I've seen it.
- mattholtom 13y agoWe can help in some small way. Advocate for the use of password managers like LastPass and KeePass that use a different securely generated pw for each site.
- NKCSS 13y agoAnd now we wait for the dump to show up... will be usefull, larger then the rockyou plain.
- deleted 13y ago[deleted]
- Jagat 13y agoAfter the adobe/cupid breaches, it is high time some governing body mandates every website to reveal on their privacy policy page how passwords are stored on their servers.
- diminoten 13y agoAnyone have a copy of the password list? 42 million passwords would be fun to analyze.
- jheriko 13y agomaybe i am just stupid, but how are password managers secure? i've seen people using them, and if i were of a less honourable persuasion i could abuse that quite easily... on the other hand, its impossible for me to steal information from out of their brain (so far at least).
- draugadrotten 13y ago> its impossible for me to steal information from out of their brain (so far at least). It's easier than you think to steal passwords from people. Just ask for it! http://www.veracode.com/blog/2013/03/hacking-the-mind-how-why-social-engineering-works/ http://www.veracode.com/blog/2013/03/hacking-the-mind-how-wh...
- lylejohnson 13y agoI've used 1Password (a popular password manager for the Mac) for several years now. How could you "quite easily" hack those passwords, assuming that's what you're implying?
- dagw 13y ago"how are password managers secure" Because now you need to steal two things. My password file and my password. Now admittedly the one weakness is that once you have both those things you have access to all my passwords, but on balance I believe it is an acceptable compromise.
- valvoja 13y agoNext article on Hacker News: "Hack of Cupid Media dating website exposes xx million fake dating profiles"?
- brudgers 13y agoWhat this story shows is that sometimes '12345' makes sense as a password - i.e. when credential security doesn't matter to the user. If I use '11111' to sign up for a onetime visit to a website, then there's no nexus with my online banking account other than an email address - assuming even the most feeble attempt at picking a 'secure' password for my banking. This is why it is often silly when articles condemn users for weak passwords when a password list is stolen. The proper assumption is that any password I use is stored and transmitted in plain text and just now falling into the hands of bad people. This is the reason that until I started expressing this idea on HN, that my HN password was "hackernews". If HN was breached, I was no less secure. Sans the pursuit of lolz, it wasn't even worth trying to guess. Of course, I changed it to something harder to prevent mischief since some individuals might have seen my comments as a challenge.
- coldcode 13y agoPeople who read HN know this. People who know nothing about security don't. Most people are lazy about things they don't know or care about. Thus it is a problem.
- driverdan 13y agoUse a password manager that generates a random password for every site.
- brudgers 13y agoProviding strong passwords on throw away accounts provides useful information to an attacker - I.e. that I am using password manager "foo". If "foo" is comprised, then all my passwords generated from it are at risk. To put it another way, where there is no reasonable chain of trust, I provide useless data for determining my strategy where there is a reasonable chain of trust. Revealing '11111' does not improve the probability of an attacker generating my bank password.
- owenmarshall 13y ago>Providing strong passwords on throw away accounts provides useful information to an attacker - I.e. that I am using password manager "foo". What? The attacker could infer: * that you consider this account to be valuable and have created your own strong password for it. * that you are a security conscious individual and keep a list of hand-generated passwords written down in a safe by your desk. * that you may be running one of any number of password managers. ... in other words, it tells the attacker nothing. That's not to say that using a junk password for a junk account is bad, just that your logic doesn't follow. >Revealing '11111' does not improve the probability of an attacker generating my bank password. Neither would me revealing my password for a throw-away service is "Sfx16tJ{=DK=x4A0v". What can you infer about my bank password from that?
- brianbreslin 13y agoTangentially related: I am a lifelock member (not sure if its worth it, but gives me some peace of mind), and recently got email alerts from them saying my adobe login info was found for sale on several blackmarket sites.
- jstalin 13y agoAnyone know where to find the password dump?
- Achshar 13y agoWhile this might sound not so appropriate at first but I too would like to have the dump. Can result in some interesting password research.
- sawthatcoming 13y agoThis was already very clear. The whole website was flawed and it probably was known by individuals for a longer time... Bypass payments, change other people's profile, read other people's messages. It does not stop here.
- Torn 13y ago> Making matters worse, many of the Cupid Media users are precisely the kinds of people who might be receptive to content frequently advertised in spam messages, including male enhancement products, services for singles, and diet pills. Oh wow. So Internet dating users are generally stupid, under-endowed, desperate and overweight?
- endlessvoid94 13y agoI was blown away this was included in the article. There's no citation, no explanation or anything. It's just blatant.
- albedoa 13y agoThey wrote "many", not "generally". And yes.
- aestra 13y ago[citation needed]
- kstop 13y agoSo that's what - 30 million male users, 1 million female, and 11 million spam-and-scam bots?
- fiatmoney 13y agoTime for civil liability for these breaches. At this point the risk of storing plaintext passwords is known enough that it should qualify as negligence.