15 ms·
Important Kickstarter Security Notice
- larrys 13y ago"No credit card data of any kind was accessed by hackers. " Ironically there is at least a clearly defined system and procedure setup to mitigate a stolen credit card number. Essentially most if not all credit card companies will wipe out any malicious charges and cheerfully replace your credit card. And hopefully if you have more than one card that's not even a problem that you have to wait. All the other information though that is: "some information about our customers was. Accessed information included usernames, email addresses, mailing addresses, phone numbers, and encrypted passwords" ...well to me that's actually more of an issue. Ironically.
- sillysaurus2 13y agoAh yes, here's another website that stores "encrypted passwords." What's an encrypted password, again? More seriously, why is the social convention to lie in these situations? Why not just say what methods they were actually using? I suppose it's possible they were storing encrypted passwords. But then an attacker would be able to break all of them at once.
- kenrikm 13y agoHashed Passwords, layman don't know what a "hash" is so they use the term encrypted since most people know what that is (even if it's incorrect terminology) It's pretty clear when they say that a weak or obvious password would be easier to crack, hash tables.
- sillysaurus2 13y agoTrue, but we'll never know if they used unsalted SHA1 or scrypt. Is there no value in putting a technical note at the end of press releases like this?
- mecredis 13y agosillysaurus2: We used SHA1, see my comment above.
- SideburnsOfDoom 13y ago> True, but we'll never know if they used unsalted SHA1 or scrypt Except that we already do know ( https://news.ycombinator.com/item?id=7245439 https://news.ycombinator.com/item?id=7245439 ) . This notice to the general public is not the sum total of their communications. (https://news.ycombinator.com/item?id=7245598 https://news.ycombinator.com/item?id=7245598 )
- deleted 13y ago[deleted]
- wglb 13y agoHashing is sometimes known as "one-way encryption."
- carbocation 13y agoFrom here forward, I will consider any disclosure involving stolen passwords that does not include a description of the password hashing/encryption/etc mechanism to mean "plaintext-equivalent passwords were taken". Edit: Changed "plaintext passwords were taken" to "plaintext-equivalent passwords were taken"
- zavi 13y agoIf they describe how passwords were hashed, it would make it easier for hackers to crack them.
- jwcrux 13y agoShouldn't matter. Something like "We hashed each password using PBKDF2 and a unique salt and a high number of iterations" doesn't help all that much. The attackers will still have a tough time brute forcing those.
- carbocation 13y ago> If they describe how passwords were hashed, it would make it easier for hackers to crack them. I don't really agree with you. If you store bcrypted stuff, you see $2a${integer exponent}$hash. If you store SHA1'ed stuff, you see characteristic hashes and can trivially test against known hashes. So on for MD5, etc. I don't need you to tell me "we store SHA1'ed stuff iterated 35 times with the following salt", but keeping that information secret wouldn't usually help you anyway. A determined attacker will test and iterate until they've figured out your scheme (or, if you're unlucky, they won't need to). Telling the attacker "we bcrypted everything" doesn't tell them anything they couldn't plainly see on their own.
- lucastx 13y agoThat's not how a properly implemented hash -- and cryptography in general -- is supposed to work. This strategy is called "security by obscurity", and is seen as a very bad one. Instead, cryptography aims to provide means to encrypt data in a way that anyone knows //how// it was encrypted, and still doesn't have a clue how to decrypt it -- because they don't have the key, in case of encryption, and because the hash is a "one-way" function, in case of hashing.
- mecredis 13y agoHi! I work at Kickstarter. To answer everyone's question regarding the encryption used for our passwords: old passwords used salted SHA1, digested multiple times. More recent passwords use bcrypt.
- carbocation 13y agoThanks for sharing. Curious: at the time of conversion, why not run everything through bcrypt, rather than keeping a dual system? (This way, the old passwords get validated with ->SHA1->digest->bcrypt, and the new passwords get validated with ->bcrypt, but either way everything in the system is bcrypted.) My guess is that it was a CPU cost decision but I'm curious anyway.
- fosk 13y agoMy guess is to avoid asking every user to change their password. From a UX perspective, it's not a nice thing to ask. This has nothing to do with security, where I agree that having one system is certainly better.
- phpnode 13y agoThere is a way to improve the security of weakly hashed passwords without having to ask the user to change their password - http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish-password.html http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish-pass...
- kleiba 13y agoNobody would have to change their password, the suggested change would only affect Kickstarter's internals. You'd still have two different systems in place like in the solution that was actually implemented, but both of them would contain a 'brcypt'.
- deserted 13y agoThe point of carbocation's technique is to avoid requiring users to reset their passwords, but to protect every user with bcrypt. The existing SHA password hashes could be used as the input to bcrypt.
- f055 13y agoWhat about the people who logged in via Facebook? (i think they don't setup passwords) Are access tokens compromised?
- mecredis 13y agoWe have reset all Facebook login credentials.
- rainforest 13y agoDoes that mean that Facebook will revoke them, or are they useless to an attacker?
- shdon 13y agoIt means the tokens are no longer valid. It's as if the user has disconnected the Kickstarter app from their Facebook account. To log in with Facebook again, they have to reconnect, thus generating a new token.
- tam7t 13y agoKickstarter requests access to "your public profile, friend list, email address, hometown, current city and likes" from Facebook on logon. With stolen access tokens the attackers could query Facebook for that information with limitations: 1) only available until the tokes were revoked 2) if enabled, attacker must also obtain the 'app secret' and sign requests 3) if enabled, attacker must use the tokens from a white-listed IP address The post only makes reference to encrypted passwords. Not sure if Facebook access tokens are included in that or not.
- LukeB_UK 13y agoWhy did law enforcement officials have to tell them that they were hacked? Surely they should have mechanisms in place to detect this themselves?
- toyg 13y agoLikely somebody got their hands on a bunch of files as part of some other investigation, and found they were the kickstarter's user db. It is indeed troubling that KS didn't detect the breach in the first place (or if they did, they kept it mum until forced by the authorities).
- cpach 13y agoIf the intruder is sophisticated enough they can find a way to fly under the radar.
- yeukhon 13y agoMaybe someone found their accounts were being used (profile changed, or money transaction occurred).
- LukeB_UK 13y agoIf they found their kickstarter account was being used, shouldn't they have contacted kickstarter rather than the authorities? If they did contact kickstarter but got nowhere and were forced to contact the authorities, then that says something else.
- yeukhon 13y agoYeah. We don't know the detail yet. It could also be a credit company advised the customer to talk to law enforcement for record. We don't know. Let's hope there is more detail.
- deleted 13y ago[deleted]
- daigoba66 13y agoHow is it that databases of password hashes can be stolen in te first place? It seems that you need a pretty severe firewall and server breech for that to occur.
- anaphor 13y agoUsually because the password database is able to be compromised by some code injection bug (e.g. SQLi). In order to prevent this you should be using a library the makes it impossible to mix code and input data like that.
- kevinbowman 13y agoMy guess would be via some kind of SQL injection.
- dublinben 13y ago>For additional help with password security, we recommend tools like 1Password and LastPass. It's really too bad that they are recommending expensive, proprietary, commercial apps for this when free, open source alternatives like KeePass exist. If users are unconvinced on the value of a password vault, charging money for it certainly isn't going to encourage adoption.
- Houshalter 13y agoHow secure is that? Couldn't they just as easily figure out your KeePass password (providing they know you are using it, and that reversing the KeePass hash isn't any more difficult than reversing the normal one.)
- dublinben 13y agoWho is they? How are they going to access your encrypted password vault?
- Houshalter 13y agoSee the comment I made above. I mean if a site like kickstarter has compromised your password even if it was from KeePass.
- euank 13y agoNo, they can't. The websites allow anyone in the world to make a guess at a password. Keepass doesn't since it requires having the private database file which you store locally. The websites allow for a vulnerability in third party code to expose you. Keepass, even if it has a vulnerability, can't be exploited remotely since the database is stored only locally. The websites are in the browser and encourage browser extensions. Browsers suck for security... that's a massive attack surface and they are, by their nature, integrated with the network. Keepass is a dedicated application with a tiny surface that barely communicates with the internet at all and has no need to. A whole class of attacks miss it. Keepass is leaps and bounds more secure.
- ameen 13y agoAs a longtime Kickstarter user, I'm going to have to delete my account. If they couldn't handle security and rake in Millions if not Billions in annual revenue. What else were their priorities? If my security is an afterthought to you, then you don't deserve my business.
- deleted 13y ago[deleted]
- tptacek 13y agoThat'll sure show them. Next time, I'm sure they'll start a business that does security better than any other company in the world, including banks, payment processors, the NSA, &c. Since, after all, that's apparently where the bar is set.
- ameen 13y agoI wouldn't have cared if it was just CC info that had been leaked as I could've easily remedy that. My personal info + password hashes are what pushed me over to this decision. I've personally given them over thousands of dollars of business and was helping others launch their projects on there.
- hga 13y agoI tend to agree: Handling Other People's Money is the essential part of their business. They didn't detect the intrusion. The last one tends to concern me in these sorts of incidents.
- akerl_ 13y agoHas anyone received this as an email (or any other notice besides reading it on their blog / news sites)? It looks like it may have been emailed to people running Kickstarter campaigns, but this really ought to be sent to all people with affected information (which sounds like all users). If they don't do that and/or expire passwords currently stored to require that users reset them, it's highly likely that a lot of users won't ever notice or change their credentials. EDIT: I did just talk to someone who is not a campaign owner and received an email regarding this, so it does look like they're in flight.
- acutelyobtuse 13y agoCouldn't agree with you more. They have no problem sending me emails about new campaigns or other activity on the site. I feel like a message about a possible security issue would have been a decent thing to do.
- akerl_ 13y agoJust logged in, it does show a banner recommending I change my credentials. But after doing so, neither the old nor new password works.
- mecredis 13y agoWe've sent an email to all affected users. They're just taking their time to arrive across the net.
- hga 13y agoI'm just a user/donator/whatever, albeit with a last name that starts with A, and I got my email notice 55 minutes ago.
- tptacek 13y agoWill you at some point consider telling us how the compromise happened? This information is useful even at a very high level; it's useful to know whether companies are breached by leaked admin passwords, or inadequately protected admin consoles, or in-app appsec faults like SQLI. Best of luck dealing with this incident. You're in great company, unfortunately. :|
- mecredis 13y agoThanks for the good wishes. Yes, we're hoping to do a post-mortem soon on our engineering blog, so that others can learn from our experience.
- tptacek 13y agoThat's generous of you, and I appreciate it.
- victor9000 13y agoThe sentiment of your comment is that transparency is somehow generous; and I could not disagree more. As user whose information has been potentially compromised, i expect nothing less.
- patio11 13y agoYou can expect whatever you want, but the norm in industry is for that sort of information to end up in a silo inside the company, and external exposure to it is permitted only under NDA or equivalent guarantees (e.g. sharing with law enforcement). What you urgently want is a cultural change on behalf of industry. This guy is part of the change you want. Biting his fingers is not the optimal path to accomplishing your goals, even if it is viscerally satisfying.
- toomuchtodo 13y agoPerhaps regulation needs to move from mandatory disclosure when credit card/payment data is leaked/lost to mandatory disclosure when credential data is lost as well. I too want urgent cultural change on behalf of industry; I'll settle for regulation though.
- yeukhon 13y agoWe recommend you do the same on other sites where you use this password. For additional help with password security, we recommend tools like 1Password and LastPass. Please don't make such recommendation. This won't change the fact that password is stored in your database. In a security breach, don't ever make such recommendation. In fact, the alert doesn't tell me exactly what happened. Are just two accounts stolen from phishing attack? Or was it a server breached? We need that detail. For disclosure, please do the following: 1. time of incident reported and the time of impact. 2. how the incident was reported 3. the severity of the incident 4. how the incident happened 5. resolution I don't mind having a first notice and then follow up by a more detailed post, but don't forget...
- tptacek 13y agoHuh? I don't follow this at all. Why should they not recommend password managers? More people should, in fact, be using them. We'd all like answers to every question we could have about the compromise. As you can see upthread, they've already committed to providing some of those answers. In the meantime, they're probably slammed with other things, and you aren't actually entitled to answers to all of your questions. You are obviously free to take your business elsewhere if their answers aren't satisfactory.
- unclebucknasty 13y ago>they're probably slammed with other things To be fair, GP did say he didn't mind if they delayed answers until they've remediated the issue. >you aren't actually entitled to answers to all of your questions. You are obviously free to take your business elsewhere if their answers aren't satisfactory. I would agree, generally. But this is an issue wherein the company has failed the trust that was previously placed in them by the customer. The customer already made the decision to give the company his business and so could incur harm, even if he subsequently chooses to take his future business elsewhere. So, I believe customers are certainly "entitled to answers". Judging from the way Kickstarter is handling this, it appears that they agree.
- 13y ago
- nodata 13y agoSo how do I reset my name and address?
- larsberg 13y agoUgh. That reset procedure did not play well with LastPass. I logged in (old password), hit change password (old password), then had LastPass generate a new password, which it handily saved over the old one in LastPass. Hit Save. And then the site asked me for the old password a third time. Whoops! I don't have that anymore...
- jyxent 13y agoHa ha. I did the same thing. If you edit your password in Lastpass, there is a history option that will show your old passwords.
- SideburnsOfDoom 13y agoYep, I had almost exactly the same thing using a different password manager. I had to find another copy of the password storage file on a different machine and bring the old password over from it. Note to Kickstarter: It is not good UX to ask for the new password, and then the old password. But that's likely the least of their worries right now.
- Silhouette 13y agoNote to Kickstarter: It is not good UX to ask for the new password, and then the old password. That is at least debatable. It might be a good idea to warn users that this will happen, if it's not immediately obvious from the form layout, but reauthenticating at the end of a lengthy or multi-step process is often a sensible precaution. Every system I use where security really matters (transferring significant amounts of money to another party from my bank account, filing statutory tax returns, etc.) does this. (This isn't to say that a process for resetting a password that required the old one three different times would be sensible. But I don't accept your general-looking claim that it's bad UX to ask for the old password after the new one.)
- huhtenberg 13y ago1. Have you leaked physical addresses that were provided to completed projects for shipping of the rewards? 2. Given the wording - "access to some of our customers' data" - will you provide a way to check if specific account was affected? Or was it "possibly all customer data"? Thanks
- arjn 13y agoI'm pretty active on Kickstarter, backing multiple projects. What's really worrying is that the Kickstarter folk didn't detect the breach themselves. It was law enforcement (I'm assuming FBI) who contacted them about it. On the security notice, Kickstarter writes they "set a very high bar" on how they serve their community. What a load of crock!. If they had a high bar this would never have happened. I wish they wouldn't rub salt in the wound by publishing such blatant rubbish. I'm extremely disappointed with Kickstarter right now.
- couchdive 13y agoExactly. You are in horrible shape if it's the police alerting you to this. My policy is "You lose my info, you lose my business". I deleted my account.
- __pThrow 13y agoI was about to change my password, when I saw "delete my account" was on the same page. On the one hand, that's a gutsy and convenient UI. However, I immediately chose to delete my account.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- roasty 13y agoPretty normal for the police to alert a company before they find out, unfortunately.
- tptacek 13y agoYou should prepare to be extremely disappointed by almost everyone you do business with online. At least Kickstarter was alerted by law enforcement and not Pastebin.
- devinegan 13y agoTime to get LaunchKey (https://launchkey.com https://launchkey.com). Seriously, any Kickstarter employee wants to talk about integration and protecting users contact us. LaunchKey is password-less multi-factor authentication. These user data breaches don't have to include the password hysteria and weaknesses.
- urethra 13y agolol you are shit at selling
- Ssyeo86 13y agoAlready got got hit with a PayPal phish trying to get my PayPal password. Clearly they are different... But seeing as they had my email they tried.
- hga 13y agoI own my domain, and use distinctive user names for registering at sites like this. I'll have to start checking my spam folder for the address I used (which I hadn't just cleaned it out...).
- Rapzid 13y ago"however it is possible for a malicious person with enough computing power to guess and crack an encrypted password, particularly a weak or obvious one." Aaaannnnddddd I'm guessing they lost the salt >.<
- aaronsnoswell 13y agoWhen the data that was stolen crops up on a forum somewhere, can someone please make one of those stub-websites that helps you check if you got stung by the breach?
- beefsack 13y agoWhen will big companies value personal information enough to encrypt it along with credit card information and hashing passwords? We encrypt all personal information at Miniand, and I do realise it makes it very difficult to query data, but I believe that's an inconvenience that needs to be accepted.
- Ladeeda 13y agoSince credit card info is safe, is there a way for names, addresses and phone numbers to be obtained through kickstarter other than through customers providing it to projects so they can have rewards sent to them?
- Ladeeda 13y agoHow can snail mail addresses and phone numbers be obtained through kickstarter, since credit card info is 'safe'? Are there instances, other than customers providing this information for rewards to be sent, in which this information can be accessed?
- areeb 13y agoI got a mail from them about it.
- areeb 13y agoHere's the mail: On Wednesday night, law enforcement officials contacted Kickstarter and alerted us that hackers had sought and gained unauthorized access to some of our customers' data. Upon learning this, we immediately closed the security breach and began strengthening security measures throughout the Kickstarter system. No credit card data of any kind was accessed by hackers. There is no evidence of unauthorized activity of any kind on your account. While no credit card data was accessed, some information about our customers was. Accessed information included usernames, email addresses, mailing addresses, phone numbers, and encrypted passwords. Actual passwords were not revealed, however it is possible for a malicious person with enough computing power to guess and crack an encrypted password, particularly a weak or obvious one. As a precaution, we strongly recommend that you change the password of your Kickstarter account, and other accounts where you use this password. To change your password, log in to your account at Kickstarter.com and look for the banner at the top of the page to create a new, secure password. We recommend you do the same on other sites where you use this password. For additional help with password security, we recommend tools like 1Password and LastPass. We’re incredibly sorry that this happened. We set a very high bar for how we serve our community, and this incident is frustrating and upsetting. We have since improved our security procedures and systems in numerous ways, and we will continue to do so in the weeks and months to come. We are working closely with law enforcement, and we are doing everything in our power to prevent this from happening again. Kickstarter is a vibrant community like no other, and we can’t thank you enough for being a part of it. Please let us know if you have any questions, comments, or concerns. You can reach us at accountsecurity@kickstarter.com. Thank you, Yancey Strickler Kickstarter CEO
- robomartin 13y agoKS FEATURE REQUESTS: I was trying to go 60 days without posting on HN. I't been 42 days. This is important enough to break my silence and at least make a request. Kickstarter: You deal with personal and financial data. Could you please enable two things for those of us who understand security issues and want better security: 1- Give me the option to not use my email as the login user id. I've warmed-up to the idea of using randomized user names on sites that allow it. Something like "aoc4sour*!Z". On such sites I have completely different and randomly generated user id's and passwords. Pretty much impossible for an intruder to associate those accounts with any other accounts. ...unless... They can access personal information such as real name, email, mailing address, phone and other personal identifying data that could contribute towards social engineering into other sites. hence... 2- Please enable an option to choose two factor authentication. This should be there as a firewall to access any personal data at all, even email and real name. It should also be required for any financial transaction, including pledging any amount on a project. I'd say make it optional because the less informed (or less paranoid) might not want to bother. finally... 3- I love questions such as "What's the name of your first pet?". How about some of those? I am being a bit sarcastic here. When answered honestly these questions are really dangerous. It doesn't take a lot of social engineering to figure out most of them when armed with enough personal data. However, I like to answer such questions with a random set of words. So, the name of my first pet might be "blue ladder tent aquifer". In other words, pretty much impossible to guess even if I gave you access to my facebook and linkedin accounts. When used in this fashion these questions, I think, are actually useful. I'd venture to guess that most people don't do it this way because they don't understand the implications of providing straight answers. These kinds of breaches have been accelerating. At least that's the feeling I'm getting. This to the point that I had a sit-down security meeting at home to make sure everyone at home understands what's going on and the fact that we need to make sure we use different passwords for every site and service and even different user names where possible. Pain in the ass but far less so than having your life turned upside-down by one of these idiots. Any thoughts, comments or improvements on the above will be highly appreciated. BACK TO LURKING: In the meantime, I am going to see about going back into mostly lurking mode on HN. I found it quite revealing to take a real break from reading and posting on HN. For the last 42 days I've checked HN's first page nearly daily and only scan a few threads very quickly, dismiss most of them and refrain from posting comments (until this one). ON ANOTHER TOPIC: HELL-BANNED? I wanted to initiate a thread to share my observations and reflections after, well, now 42 days of just glancing at HN and not posting. However, either I am the subject of a strange hellban or something is broken. I can post comments all I want but I don't seem to be able to start new threads. Not sure how to fix it. Too bad.
- mcgwiz 13y agoI had an incensed reaction to their email, which had only stated that the passwords were "encrypted". Not until I searched these comments here for the text "encrypt" did I learn that they actually hashed with bcrypt. I humbly suggest all security notices like this that are sent in the future, if written with the word "encryption" rather than "hashing" for the layperson's sake, have an asterisk next to the word "encryption". At the bottom of the email, the explanation "hashing with {{algo}}" where "hashing" links to [1] would be included. Laypeople get their simple explanation, technical people don't get too angry. And some laypeople may click through the link and learn something. [1] http://en.wikipedia.org/wiki/Cryptographic_hash_function#Password_verification http://en.wikipedia.org/wiki/Cryptographic_hash_function#Pas...
- Kiro 13y agoWhy is bcrypt better than SHA-1?
- shdon 13y agoSHA-1 has been considered weakened since 2004 and it is recommended not to use it in new cryptosystems. It's not the worst hash out there, by far, but it can be calculated relatively quickly which may make finding collisions easier as new insights and faster technology becomes available. Bcrypt has a variable number of iterations in the algorithm. Increasing the number of iterations makes the hashing a lot more computationally intensive. Sufficiently so to make brute force attempts intractable for now. And even when somebody has the computing power to easily calculate your hash, increasing the number of iterations will negate that advantage.
- cpach 13y agoSo I received a mail from Kickstarter and I changed my password and went on with my life. I don’t think the intruder will find any use for the bcrypt hash[+] of my password. Especially as that password has never been used for any other site. [+] Or whatever the cryptograhpers call it :)
- hga 13y agoWell, identifying information might have been lost, for those who get stuff sent to them. But you're spot on with the unique password, I make very sure to use one for every site that has anything to do with money.
- cpach 13y agoPersonal information will always be leaked in various ways. Major web sites without any breaches can probably be counted on one hand. People who cannot tolerate this should probably get a post-office box, provide a false identity and/or keep their user account registrations to a minimum.
- masklinn 13y agoStill changed mine: * Changing it is pretty much trivial: generate new password, plug in site, save * I may have set it before KS started using bcrypt, and I'd rather not have third parties log in my KS account, even if (as far as I can see) there's nothing they can do with it
- cpach 13y agoYeah, I changed my password as well. A good thing with randomly generated passwords is that one doesn’t really grow that attached to them ;-)
- rybosome 13y agoDidn't store my credit card info with them, used a long, random, unique password from a password gen, not terribly concerned. The peace of mind this buys me is absolutely worth the hassle of setting it all up, and the accusations of paranoia from more relaxed friends and family.