Slashdot Mirror
Wikipedia Leaks Some Users' Passwords
JJ Budion writes "If you've signed up for an account on Wikipedia.org, you may want to check this page to make sure you're not on there. It seems certain users with identical password hashes can find other user names with the same password, and Wikipedia (despite being alerted) has done nothing about the problem for the last year. A good (although slightly inflammatory) description of the problem can be found here. This is probably a good occasion to remember to use strong passwords (apparently only users with common passwords, like dictionary words, are affected)."
To be clear, this isn't a case of Wikipedia "leaking" passwords or allowing some kind of exploit via technical means; this is Tim Starling deciding to specifically and literally publish a list of usernames that share the same password, ostensibly for the purpose of revealing trolls and flooders with multiple accounts.
From the looks of a few of the lists (RickK, RíckK, RìckK, RiÄkK, RïckK, RiÄkK; Mäximus Rex, Maximus Rex, MaximusRex; JíangSlumDawg, JiangFlungDung; LlortTheehtTroll, LlörtTheehtTröll; The Two Trolls,The Fellowship of the Troll,The Return of the Troll,The Trolls of Navarone,Troll Silent, Troll Deep,The Trolling Stones, RangelaND Visa CONtroll), it would appear that some of these are indeed obvious duplicate accounts (whether or not they're "trolls" is, I imagine, beside the point).
But it seems that he also caught a bunch of innocent folks who just happen to share the same password, not beyond the realm of comprehension for a password used for an "online" non-financial, non-critical site on a service with thousands of users. The submission makes it seem like Wikipedia knew about some kind of "exploit" and did nothing; rather, it seems like Wikipedia is content to let potential, and indeed confirmed in one case as admitted on the page, abuse of innocent users' privacy continue in the name of exposing possible (admittedly annoying) trolls. (That's my own take on the situation, anyway.)
Interestingly, Wikimedia's (draft?) Privacy Policy says:
Many aspects of the Wikimedia projects community interactions depend on the reputation and respect that is built up through a history of valued contributions. User passwords are the only guarantee of the integrity of a user's edit history. All users are encouraged to select strong passwords and to never share them. No one shall knowingly expose the password of another user to public release either directly or indirectly.
It appears that, in this case, Wikimedia itself is implicitly "knowingly" releasing passwords to the public. One of the many problems with a community site for which there is no central responsible authority. Anyone who hasn't yet would do themselves well to read the summary of the issue linked in the submission.
I guess it is a good thing that I use "TheCowJumpedOverMyMotherInLaw" as my password... no one will ever figure that one out
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Please make yourself a new account or two. Seriously, the rather inflammatory summary didn't tip off the on-duty editor that this might not be that big a deal? 100 names out of how many? Gimmie a break.
Additionally, every single post I've seen associated with this looks like someone just looking to drum up trouble for Wikipedia. Look at the list, and you'll notice that a lot of them, yes, are copies. And if they're not copies, you should have used a better password anyways, there's not even numbers in those... On top of that, the developer in charge of that little page seems like quite a decent fellow.
Shame to you for not editing that summary a bit.
My little site.
Bah...you mean that I can't edit other people's passwords too?
and I'll say hit again, hotgrits is not a safe password
Um...didn't this happen like a year ago?
____
~ |rip/\/\aster /\/\onkey
If they're going to succeed in portraying Wikipedia as a mature, reliable alternative to traditional encyclopedias, then they aught to make damned sure that their ducks are in a row. Their disregard of customer concerns is a shameful.
If, in the long-term, Wikipedia's image is tarnished by this, it is well-deserved.
"Ask not what your country can do for you." --John F. Kennedy
the two guys with "Ilovetehfatchicks" as their password who showed up on each others list are just looking at each other right now. They know the other guy knows, but nobody else does, so the uncomfortable, pregnant, silence continues.
...To "tr0ll" I guess.
Pulp Audio Weekly - Geek News and Reviews
Cue the spaceballs references ...
if you think this is bad, you should have seen my last sig
Perhaps they should try this:
http://en.wikipedia.org/wiki/Password_policy
to try to avoid this:
http://en.wikipedia.org/wiki/Password_cracking
Salt, anyone?
Anyone who, in this day and age, writes a system whereby two users assign themselves the same password and end up with the same hashed password ought to be shot. Add a little SALT!
Everybody's a libertarian 'till their neighbour's becomes a crack house.
I really believe this is an abuse of privileges, or a gross security oversite by Tim Starling. Knowing this information, I could likely gain access to these users' accounts on other, completely unrelated systems. Suppose I was on one of those lists (I'm not). Immediately, I know the password of everyone in my group. Now, suppose I start searching other sites, like /. for those usernames. Think they might use the same password on two different systems?
apparently only users with common passwords, like dictionary words, are affected
I guess I'm safe then... I doubt that anyone has eU5L83Bs as their password.....
Oh wait....
"Alright, what are the three most commonly used passwords?"
;)
"Love, secret, and uh, sex. But not in that order, necessarily, right?"
"Yeah but don't forget God. System operators love to use God. It's that whole male ego thing."
Personally, I like to use "Tehl33th4x0rb0y", because it satisfieds the strong password requirement
IGB: More fun than eating oatmeal!
Great, now i have a list of username which can easily be cracked with a dictionary crack.
The GeekNights podcast is going strong. Listen!
Good thing my password is *********.
Noise Is Music Podcast.
Apparently this is over a year old and is being spun by the article submitter.
Secession is the right of all sentient beings.
Why the fuck was this modded down 'redundant'?
If you bother to do the research, you'll see that all this shit started in July of 2004.
That's right...Zonk posted a story almost ELEVEN MONTHS OLD, and calls it 'news'.
and then TMM points it out and is modded 'redundannt'.
nice.
anyone done a wiki on this?
I'm a rabbit startled by the headlights of life
I'm still waiting on who actually uses Wikipedia as their primary source of information. :rollseyes:
Avarus animus nullo satiatur lucro.
Given that I just create a new username & password on the fly any time I want to write something to wikipedia, because it is so lightweight to create an account (don't need email, and it gives you a link to go back to where you were -- very convenient), I'm not sure how much this affects me :) :)
Good god, this "human" filter is horrible...
Quote:
All the accounts listed on this page have been created solely for the purpose of trolling, and this page was set up to make it easier to determine whether two troll accounts belong to the same person.
No passwords have been leaked, and the only people affected are trolls.
I use my dog's name as my password.
My dog's name is currently "rV4q-p2", but I change it every 90 days.
For once, we should not attribute to incompetence what can be explained by malice?
1) Those heading titles aren't the passwords themselves, just one member from the group. The original passwords are encrypted and unknown. These are users with the same hash. Nobody knows if they used a password like "my_pass_word" or like "ar49B!4Nc&&". Password strength is irrelevant. Besides, the developers of any site always have access to your password hashes, since someone needs full read access to the databases.
2) A quick glance at those lists shows that they're all duplicate ("sock-puppet") accounts, and they're mostly from trolls. If you haven't watched Wikipedia much, you may not know the illustrious story of the sock-puppets, but even seemingly unrelated names (e.g., Lir and Pizza Puzzle) are widely believed to be the same user.
3) This story is what they call "FUD". If someone finds a valid user's account among these, then tell the user, and say that you found one (you don't have to say who). Until then, since the page appears to be all sock puppets, don't assume that there are innocent civilians caught in the collateral damage. As the page says, "all the accounts listed on this page have been created solely for the purpose of trolling." Only when that claim is disproven does the page become a worry.
-- User:Geoffrey on Wikipedia
Whats freaky is the guys name is Tim Starling.. We have like the same name so when i cliked the link I was like omfg how do they know who I am, but I re-read it and realized the two letters are in different places in the last name -_-
My password is always the first 17,000 prime Fibonacci numbers!
If you had bothered to check your facts, you would see that Tim Starling's list was made last July, well before the privacy policy was written. Also, the impetus for him doing this was to catch one particularly troublesome user who was known to use sockpuppets accounts like this all the time.
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
It is a case where a Wikipedia troll has succeeded in using Slashdot as his tribune. Pity the /., editor, he'll be flamed now...
VKh
First, this was not a technical flaw - this was one developer intentionally looking for identical password hashes. Second, this is not news - the page in question was created last July as a one time thing to flush out trolls.
Why would we publish a list of account with identical passwords? Because certain trolls are known to register multiple accounts with the same password, and use them to troll, vote stuff, and all sorts of other unpleasant activities. Of course, many times, it is not hard to guess who those accounts belong to based on editing habits, but of course the trolls in question will deny it. But being matched by password was a one-time way to shoot through all their lies. This whole story is old, and the summery is horrible biased.
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
Even though this isn't a "big deal" - that is, no passwords are leaked per se, and accounts with similar passwords as the parent rightly noted are most likely indicative of a single user with multiple accounts, there is a better way to store passwords. Given H(P1) and H(P2), it's trivial to prove that (probably)P1==P2 or (certainly)P1!=P2, which is leaking information. Thus, storing H(P1) and H(P2) is a poor way to preserve secrecy of P1 and P2. A just-as-easy approach would be to salt the hash: store H(username1||\0||P1) and H(username2||\0||P2) -- where || is the string-concatenation operator. Assuming no two usernames are the same, and \0 is an invalid character for both username and password, then nothing is leaked about P1 and P2. (Note, \0 is essential because if username1 is "tomharrison" with password1 = "city" and username2 is "tom" with password2 = "harrisoncity", then we leak information that user2 has user1's password prepended with "harrison" unless we have \0 dividing user and password strings) I would actually prefer true salting: H(random1||P1) and H(random2||P2) where random1 & random2 are random (& mathematically non-secret but you shouldn't feel inclined to publicize them) constants stored alongside the username. This avoids the ugly hack of relying on \0 being special. Unfortunately, this relies on change of datastructure instead of a change in the hash function and hence isn't "just-as-easy".
No, it's a developer using an "ends justifies the means" argument to catch sock puppet accounts created by people too stupid to assign them unique passwords.
Unfortunately, he didn't think "gee, this might catch some legitimate users off guard", and as a side effect, we see that Wikipedia developers didn't use salts for the passwords, which indicates just how lax they are about security (which is part of the article's point).
What you seem to be doing is diverting our attention away from the legitimacy of the claims (insecure Wikipedia code, lack of common sense, etc) by simply saying "the author of the story is a troll!"
it would appear that some of these are indeed obvious duplicate accounts
Then why didn't the developer simply remove them? If they're troll accounts, the people won't complain, most likely. If they do, say "oops, sorry, we had a little hiccup" (the swamp gas refracted polarized moon light off the stramospheric sub-layer). Problem solved. If submitted edits are tied to accounts, move the edits into a "holding area" for a month where they're not visible to the public (ie, back them up).
This seems like basic sysadmin 101, sorry.
Please help metamoderate.
A few other people have said it, but you may as well hear it from the source.
That was the only time I published such lists. They were constructed by searching the database for password matches with the few most active trolls on Wikipedia at the time. People complained about the possibility that innocent users with weak passwords might have been affected. I conceded the point, apologised, and promised not to do it again. The issue was played up at the time by the trolls who were exposed -- not surprisingly, I wasn't winning any friends in that camp. Those same trolls still whinge about the existence of the page today.
At the time, some people wanted the page deleted to protect any innocent people who might have been listed. The majority wanted the page kept as evidence against the trolls. I had no opinion either way, and so let the page remain in accordance with community wishes.
Nobody has ever identified a non-troll account on that page. No innocent person has complained to me that they were affected. None of the accounts (aside from the known troll accounts) had any identifying information associated with them.
The page of troll names has been around July of last year, and according to the author, is a careful collection of verified troll usernames. The passwords are NOT leaked. The user has simply created a page to collect verified troll accounts (using password hash matches, among other tools). Odds are that the person submitting this to Slashdot and K5 was one of the trolls, themselves. Ha, and Slashdot fell for it! Major troll victory.
Repeat, the passwords were not leaked... But, if my Wikipedia password is leaked, so what? Some loser-hacker can change my preferences so that math code looks funny? Whoop-ee-freakin'-doo. If my Wikipedia account gets deleted, I'll just make another. Is there anything inherently valuable in a Wikipedia account?
This is being blown out of proportion in typical Slashdot fashion.
Ceci n'est pas une pipe.
Cthon98> hey, if you type in your pw, it will show as stars
Cthon98> ********* see!
AzureDiamond> hunter2
AzureDiamond> doesnt look like stars to me
Cthon98> *******
Cthon98> thats what I see
AzureDiamond> oh, really?
Cthon98> Absolutely
AzureDiamond> you can go hunter2 my hunter2-ing hunter2
AzureDiamond> haha, does that look funny to you?
Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as *******
AzureDiamond> thats neat, I didnt know IRC did that
Cthon98> yep, no matter how many times you type hunter2, it will show to us as *******
AzureDiamond> awesome!
AzureDiamond> wait, how do you know my pw?
Cthon98> er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
AzureDiamond> oh, ok.
There are 2 kinds of people in this world. Those that can keep their train of thought,
here
Unfortunately, Tim at the time didn't run a password checker against the hashes, which could have thrown weak passwords out of the list and thereby prevented legitimate accounts from being included with reasonable effectiveness.
The submitter clearly has an axe to grind (and may well be identical to the comment poster). No similar lookup has taken place since July 2004, so this story is a tempest in a teapot.
I would agree with the criticism in one regard: The decision not to delete the page was mistaken. One problem was that the deletion request came from a troll, which made a lot of people vote to keep the page "by default." The other problem is that the technical arguments to delete the page came in too late to make a difference.
In any case, as noted, this was months ago, has not been repeated since then, and any non-troll among the listed accounts can simply change their password. We're not talking about credit card data here, anyway -- creating a Wikipedia account takes 20 seconds and doesn't even require a valid email address. All that it contains are a bunch of user preferences.
is easy; salt your hashes.
For each user, generate a string of bits that is at least your cipher block length (160 bits for SHA1, IIRC)... save that string (cleartext) to the user profile. Then when you hash the password, add the "salt" to the end.
password + salt will always hash to the same value. And no two users with the same password will have the same hash. Problem solved.
I am disrespectful to dirt! Can you see that I am serious?!
that all passwords should be "different".
... you should use a a really common password. That way, if your cover is blown, you'll have at least the consolation that you'll find a nice phull bucket of phish on Tim Starling's page!
Way to stick to your guns dude. You have to be pragmatic in situations like these, and I think you did the right thing. This whole article should be modded -1 flamebait.
Top 10 Reasons To Procrastinate
10.
1. You should never have a password appear in a publically readable "hash" or URL parameter, even if it's one-way encrypted
/. or nytimes registration) that don't really matter
2. You should NEVER use a password for a site that's the same as an important password
I tend to have three tiers of password:
1. "junk" passwords for non-critical sites (like
2. secure passwords for web-based email, etc, that I wouldn't want getting out
3. High-security passwords for banking, etc (these are different for each site, and I write them down and keep the list in my safe.)
Best Buy can have you arrested
Forget the LONG-WINDED tales of "salt". It's like this: You cook up something good, and to tweek it just the right about, you add a pinch of SALT. Think about it.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
What is so wrong about relying on \0 being special? In fact, when working in languages that for some reason or other don't like working with null bytes (I'm looking at you, PHP), I've replaced \0 with qnblwfoqiwbegasfoi, which technically would be a legal part of a password, but is statistically assured never to be chosen by anyone.
(Purists always hate it when I say something like this. Oh well.)
-- If no truths are spoken then no lies can hide --
That worthless Microsoft..., wait I mean switch to Lin..., I mean stupid DMCA lawyer...oh nevermind, someone that we all like is at fault, we'll ignore it.
haheee ! :D :D :D
It gave me a good laugh
Imagine: there's some chance that someone could use this to reduce the reliability of data on Wikipedia! The horror, the horror...
TWW
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
If a website registry restricts accounts based on a chosen password being duplicate to an existing user's password, it's almost as though that password is verily being utilized as secret private-side username. Why wouldn't a password be unique as though a name or IP address of a recursive subnetwork? This is the founding premise for biometric identification as a password; looking for a unique trait to be used as authentication rather than the graceful suggestion of the account holder.
Turning the worm: That unlawful administrator is no different than a terrorist and needs to be accused for violating the good faith of participants in the act of unjustifiedly revealing any authoritative statistic of WikiPedia participants' entrusted secrets. All the information entrusted to WikiPedia is copyright limited by the respective owners; any agreement implied or coerced that suggests contrary to the charter of a service wholesomly notwithstanding. Do you suppose WikiPedia is among those websites that presses agreements that amount nothing more than an indemnification of the corporation as though a sovereign? eBay, Yahoo, Microsoft, United States, and whatnot all behave similar agreements of such. It seems these creatures of a state can only live when people breathe life into them. WikiPedia would surely rot if everyone retracts their copyright information, so would other corporations for that matter.
without prejudice
I seriously doubt they've stored them as anything other than plain text if they're able to match up passwords.
:(
:(
Of course, if they're hashing the passwords without a salt, hashing them is likely quite useless, as anyone who can get ahold of the password hashes will have a significantly easier time than they should.
But in all honesty, I *really* think this means they're storing the passwords as plaintext, which is a REALLY BAD IDEA.
I'd change my Wikipedia password if I had one, and change the password to any other accounts I had which share that password (hopefully none--you guys do know better than to reuse passwords to important things on unimportant sites like Wikis, right?)
But yeah, while I understand their reasoning, it would appear to point to bad security practices which could be dangerous. With that many users, enough of them are probably dumb enough to reuse the passwords, making Wikipedia a nice, juicy target for the malevolent
Anyone storing passwords in plaintext in this day & age, or hashing them without a salt deserves a knock upside the head. It's just not right
You can't seriously believe they're hashing the passwords with that setup, can you?
Granted, they could be hashing them with a constant or no salt at all, but I don't seriously believe they have them any better protected than plain text.
Least. Important. Security. Breach. EVER!
If you retroactively apply the privacy policy (which makes no mention of being retroactive), AND you ignore the fact that this user left before the policy was even formulated, then one user (out of 109) might have had his privacy violated by telling everybody his hash matched another user's. And this merits a slashdot front-page story?
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
...just got wikified and PWN3D!!1
I edited a few Wikipedia articles and made one, but (from reading the story) I'm very glad that I did so anonymously. Now if someone leaks my Slashdot password, they are just asking for a beating...or something like that.
You can hold down the "B" button for continuous firing.
"This is probably a good occasion to remember to use strong passwords (apparently only users with common passwords, like dictionary words, are affected)." to look it up - it was only just last week - but someone here suggested using physical location based passwords...it seemed a pretty good suggestion to me, and I've gone ahead and modified all of my passwords to reflect where I most often log in to things from.
Theres a slight problem with this, though...I can't remember what the girl I was staring at while doing all of this at a nearby coffee shop was wearing, and now I can't log into anything but slashdot!
"How like you to drag your keyboard to a gun fight." - Aaron Bedard (BANE)
Also, from the queue on K5, this article might just be the death squirms of the nailed troll(s) anyway.
True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
Its an encyclopedia so they need to have referenece on usernames and passwords.
Those who, like me, don't quite know what a salt is in hashing, can consult wikipedia.
The article is a stub, so it could use some improvement I guess.
> Perrak does not count as he is not an active user
WTF? Don't you realize that a lot of people use their password
on more than one site at a time? What a stupid motherfucker
you are.
The default behavior in MediaWiki is to use salted hashes.
On Wikipedia we've inherited older behavior (along with the older database) to use non-salted hashes as a stopgap until a mass user account migration is done to provide some single sign-on capability between our wikis; the salt would make it impossible to migrate without getting everyone to reset their passwords manually.
Depending on how we do it we may end up doing that anyway though.
Chu vi parolas Vikipedion?
Some of your faulty entries could be replaced by other faulty entries written by somebody else.
Good gracious. You admitted you fucked up, but then proceeded to do nothing about it -- not even notify the people who might have been affected?
If you worked for me as a developer, much less a database admin, I'd fire you on the spot. You better hope your boss doesn't find out about this.
You should never have a password appear in a publically readable "hash" or URL parameter, even if it's one-way encrypted
This hash wasn't exactly "publically readable". It was readable by anyone with developer access.
High-security passwords for banking, etc (these are different for each site, and I write them down and keep the list in my safe.)
For most banking sites, anyone with access to your email can change your password to your banking site. So in my opinion the password to your email account is the one which needs to be the most secure.
Personally I use a hash of the site's domain name concated with my "master password". This has the disadvantage that it allows someone who can guess my hash scheme and has my hashed password to run an offline brute force attack on my master password, but has the advantage of not having to ever write anything down (and thus not risking forgetting or losing anything as long as I remember the master password). I actually use two different passwords for my master password - one for banks and shit like that and one for sites with clown admins like Slashdot and Wikipedia. Anyway, I certainly wouldn't trust my life to this scheme or anything, but it's good enough for stuff like online banking - if someone actually compromised my online banking password they'd probably get caught if they tried to actually use that password to steal anything.
I haven't seen that particular error... Might be an intermediate cache run by your ISP, or if you have a local proxy (ad blockers, etc) it might be timing out related to the slow connection and our overloaded servers at peak hours.
Chu vi parolas Vikipedion?
Also, from the queue on K5, this article might just be the death squirms of the nailed troll(s) anyway.
Oh yes, indeed. Because anybody who makes a concerted habit of trolling Wikipedia is gonna consistenly use the same password on all their accounts.
Right.
that wiki can also be translated to mean "hyperdefensive"
Those who sacrifice security to condemn liberty deserve to repeat history or something. - Benjamin Santayana
To the extent it actually existed in the first place, this hole has now been closed. Wikipedia turned on password salting tonight while performing other routine maintenance (namely, adding a few indexes to increase performance).
Hey, you try to find an open nick these days!
Please choose your desired username: Neo ...
p ?admin=false. I've also heard stories about addtocart.aspx?id=324&price=499.99
Username Neo is already in use.
Please choose your desired username: N30
Please choose your password: mypassword
Password mypassword is already in use by user ThePlayaHater.
Please choose your password:
Unrelated, but funny from a retarded security standpoint: I work as a developer/tester for a small company. The developers all test eachothers' code because we don't have the budget for testers. Anyhow, testing an application that one of my coworkers wrote, see if you can guess how I hacked it just by looking at this url: http://www.somesite.xxx/creditcardnumbers/edit.ph