Brian Moylan: Uh oh....3chan is apparently posting usernames and passwordsIt's too bad more-or-less innocent sites like Lifehacker had to get caught in the crossfire as part of the Gawker network. At least Wonkette escaped unscathed by going independent awhile back. (And I'm glad cool-in-my-book Jim Newell was the one not being annoyingly flippant in that chat log.)
[link]
Richard Lawson: I'm not clicking on that
whose usernames and passwords?
Hamilton Nolan: that seems bad, right
if it's ours, that's a problem
Jim Newell: they were not ours. I couldn't really tell what was going on
Brian Moylan: gawker users
Hamilton Nolan: oh, well. unimportant.
Richard Lawson: just the peasants?
It is a statistical certainty that 4channers would one day be Presidents of countries around the world. I take comfort in the fact that I'd be dead by then.How old are you? And do you mean regular posters, people who have posted one comment, or everyone who browses the site?
127.0.0.1 gawker.com 127.0.0.1 www.gawker.com 127.0.0.1 gizmodo.com 127.0.0.1 www.gizmodo.com 127.0.0.1 kotaku.com 127.0.0.1 www.kotaku.com 127.0.0.1 jalopnik.com 127.0.0.1 www.jalopnik.com 127.0.0.1 lifehacker.com 127.0.0.1 www.lifehacker.com 127.0.0.1 deadspin.com 127.0.0.1 www.deadspin.com 127.0.0.1 jezebel.com 127.0.0.1 www.jezebel.com 127.0.0.1 io9.com 127.0.0.1 www.io9.com 127.0.0.1 fleshbot.com 127.0.0.1 www.fleshbot.com 127.0.0.1 gawker.tv 127.0.0.1 www.gawker.tv 127.0.0.1 cityfile.com 127.0.0.1 www.cityfile.com 127.0.0.1 valleywag.com 127.0.0.1 www.valleywag.com 127.0.0.1 defamer.com 127.0.0.1 www.defamer.com 127.0.0.1 sploid.com 127.0.0.1 www.sploid.com(I doubt anyone else here is as angry and vindictive as I am, but if you are, this might save you some time.)
affects every site in the Gawker network, including Gizmodo, Kotaku, Lifehacker, Jezebel, Deadspin, Jalopnik, and io9.Is this a complete list? Is there a complete list?
[username] ::: [13-character alphanumeric string] ::: [60-character alphanumeric string with special characters] ::: [email address]...what parts are needed to theoretically recover a password? Some entries have "NULL" for the second field, or the third field, or the email field, or some combination of the three. I think the second is the DES, and the third is some kind of hash. If a "NULL" in the right place(s) means the data is safe, that'll give a lot of people (including me) some peace of mind, since a lot of the entries in the file don't have information in all four fields.
The whole Facebook / Twitter / Google / OpenID log in thing that's happening now is extremely convenientI find it (OpenID aside) annoying. Why should I have to tell all these sites "who I am"? What if the one account gets compromised, or blocked, or something?
Assuming that you are talking about this link:Just how the heck are you supposed search that link?Yeah, could somebody please post a step-by-step on how to search for one's info there?
Easy I get. But secure? I have no trouble coming up with strong passwords myself, and I always use a unique password for every account. There are all kinds of ways to do this. Mnemonics are great - think of a sentence and use the first letter of every word. Add some numbers that were meaningful to you as a child for whatever reason, and maybe some that are meaningful to you now (but nothing obvious or predictable). Sprinkle liberally but in a way you can remember. Actually use your passwords by typing them in each time you need them and you will find that you will remember them eventually. But no, that's work, nevermind.I have literally hundreds of accounts, each of which has its own unique password, each looking something like:
Although I still don't get how your secure password is so secure if you somehow have to spend three hours changing all passwords everywhere because *one* account was hacked.Why do you think that we would have to do this?
I don't see anything about that in their privacy policies. However, there's a bunch of stuff about never being liable for anything, ever. Perhaps you could find the section that promises to warn you?It doesn't matter what their policies are, they're required by law to inform you of a data breech. (the law was put in place in part because hackers would blackmail companies to prevent the release of stolen data).
MD5 and hashes and salted vs. unsalted, but it's all over my head."MD5 hash. Given a password, the MD5 algorithm will spit out a 128-bit hash (5f4dcc3b5aa765d61d8327deb882cf99— this is in hexadecimal, so there are 32 characters). You can generate the MD5 hash for any password pretty easily. There are two things you basically need to know about MD5 hashes:
MD5 hash, it's very difficult to retrieve a password.MD5 hashes (a lot, even for very fast computers).MD5 hash shouldn't be able to reverse it easily. If I tell you 5f4dcc3b5aa765d61d8327deb882cf99, you shouldn't be able to figure out that it says "password".MD5 hashes, it would be infeasible to try every possible hash. I would have been happier to see it happen to Drudge, but it never would, because he doesn't allow comments. The only voice allowed on Drudge Report is Drudge's.If this had happened to Drudge, come January, we would have a Congressional act to disallow people from writing open source computer programs, such as were certainly used in this attack.
So I've been thinking about jumping on the KeePass etc. bandwagon for a while, but I keep putting it off, largely because I'm worried about what happens if KeePass gets hacked, or if my computer crashes and I need to rebuild from scratch, or whatnot.Yes, you should.
Satisfied password-manager-users: should I be worried about this stuff?
Date: Tue, 24 Nov 2009 03:14:32 GMTFor those of us who haven't visited Consumerist or some of the other related sites in the past year, this is a big relief -- though our e-mail addresses are still outed.
The Consumerist has moved! In order to post comments on the new site using your current account, you'll need to log in with your username and the temporary password below. After logging in, you can reset your password. You will have immediate access to your profile and can start commenting on the new site.
Current Username:
Current Password: (random junk)
My password is one I use a lot for other accounts. It is an English word, but it's a word that many people haven't heard of. It is shorter than that Md5/hash/thing. However, it is NOT the same password I use for Livejournal, my bank accounts, or my email.If it's an English word, it will be in some dictionary file somewhere. Pretty much every English word, plus common and uncommon variations, misspellings, abbreviations, etc will be tested. So, what you should do is find every site you do use that password and change it. And for 'cheap' security (as in, would fool spammers, but not someone who had personally taken an interest in you, like an ex-bf or something) you can use a modified version for each site.
What the hell should I do?
Can someone explain why there are still websites that don't allow you to use special characters in your password? Like some banks, for example?Really, really bad programmers? Or perhaps they want to be able to read the password over the phone while talking with a phone-rep who might not know the names of the symbols.
Lucky me-- I got an account at io9 this week, using (I believe) one of my Regular Passwords. But I checked the google spreadsheet, using the MD5 technique kindly detailed by Yaymukund, and I came up with nothing. So... does this mean I dodged a bullet here?Well, it wouldn't hurt to change your passwords just to be safe. And honestly, this really rises how important it is not to re-use the exact same (as opposed to similar) passwords. Even if you totally trust the guys running the site, can you trust that their security is top notch and unhackable?
Any password manager worth its salt will encrypt your password file with a standard algorithm like AES.It's the same crypto that Wikileaks uses for it's insurance file :)
And when they have finished hiring a real security person and drafting an incident response plan, they can create a password composition and management policy, a policy on not writing passwords in chat logs, a patch management policy, and maybe for kicks a policy against bad mouthing their own users internally, users that they themselves put in harm’s way.posted by We had a deal, Kyle at 11:16 AM on December 13, 2010 [5 favorites]
echo -n "password:metafilter.com" | openssl dgst -sha1 -binary | openssl enc -base64If you change "password" to "p@ssword", yeah, that's probably not going to help you much, but quin didn't specifically say to make a substitution like that. Changing "password" to "pas@sword" might actually help.The easiest way to instantly make any password vastly more secure is to throw a !, or a @ (or any non-alphanumeric) in there somewhere.Isn't this no longer the case given that most substitutions are predictable and easy to algorithmically cover?
# Try words as they are
# Lowercase every pure alphanumeric word
# Capitalize every pure alphanumeric word
# Lowercase and pluralize pure alphabetic words
# Lowercase pure alphabetic words and append '1'
# Capitalize pure alphabetic words and append '1'
# Duplicate reasonably short pure alphabetic words (fred -> fredfred)
# Lowercase and reverse pure alphabetic words
# Prefix pure alphabetic words with '1'
# Uppercase pure alphanumeric words
# Lowercase pure alphabetic words and append a digit or simple punctuation
# Words containing punctuation, which is then squeezed out, lowercase
# Words with vowels removed, lowercase
# Words containing whitespace, which is then squeezed out, lowercase
# Capitalize and duplicate short pure alphabetic words (fred -> FredFred)
# Capitalize and reverse pure alphabetic words (fred -> derF)
# Reverse and capitalize pure alphabetic words (fred -> Derf)
# Lowercase and reflect pure alphabetic words (fred -> fredderf)
# Uppercase the last letter of pure alphabetic words (fred -> freD)
# Prefix pure alphabetic words with '2' or '4'
# Capitalize pure alphabetic words and append a digit or simple punctuation
# Prefix pure alphabetic words with digits
# Capitalize and pluralize pure alphabetic words of reasonable length
# Lowercase/capitalize pure alphabetic words of reasonable length and convert:
# crack -> cracked, crack -> cracking
# Try sequences of adjacent keys on a keyboard as candidate passwords
hint's founders include veterans from WSJ.com and Heyzap - the same people who architected the infrastructure for their ecommerce & authentication systems to scale to 200,000,000 Pageviews per month & $100 MM per year and who have unique insight into best practices for virality, monetization, and user acquisition/ retention.Emphasis mine.
« Older Porky in Wackyland vs Dough for the Do-Do... | Dr. Seuss does Star Wars. Tran... Newer »
This thread has been archived and is closed to new comments
posted by phrontist at 7:01 PM on December 12, 2010 [10 favorites]