Slashdot Mirror
Mozilla Posts File Containing Registered User Data
wiredmikey writes "Mozilla yesterday sent an email to registered users of its addons.mozilla.org site, letting them know that it had mistakenly posted a file to a publicly available Web server which contained data from its user database including email addresses, first and last names, and an md5 hash representation of user passwords."
at least they told their users
TFA says that it was the user database of the AMO (addons.mozilla.com) website, nothing to so with the Sync server.
http://blog.mozilla.com/security/2010/12/27/addons-mozilla-org-disclosure/
Active accounts have their password SHA-512 hashed with per-user salt, so they're safe (for a while). However those 44,000 holders of older (and now disabled) MD5 hashed accounts should rush changing their passwords elsewhere, if they have the bad habit of using the same password everywhere...
There's a browser safer than Firefox, it is Firefox, with NoScript
This is really well played by Mozilla. We are witnessing a prime example of crisis-communication. The basic rules are:
- Communicate early (even if you don't have all the facts yet)
- Communicate honestly (even if you're to blame)
- Promise follow-up (as needed)
Performing their crisis-communication this well will probably improve public perception of Mozilla. It will certainly raise the bar for other companies.
I have a photographic memory for numbers. I know almost a hundred of them.
I mean, why make it difficult for identity thieves?
Oh Boy, Julian really did it this time!
I'm being Insightful or I'm trying to be funny. Seriously, no trolling! Maybe!
But that doesn't excuse the fact they messed up in the first place. What mozilla have done is plain careless. I know, 'accidents happen' - but I'd rather they didn't and I don't trust companies not to keep making mistakes with user data.
why you shouldn't give anyone personally identifyable data in the first place. Because personally sensitive data is like the genie in the bottle: Once it's out, there's no putting it back. No, I don't know what "anonymous registrations" would look like. Let's find out.
Seems like just yesterday I was deleting my Gizmodo account...
One more reason to (a) use fake names everywhere except your bank accounts and, (b) use a password safe application like KeePassX or LastPass to save unique passwords for every site you visit.
This will minimize your exposure when something like this happens again at another site.
I applaud the timely and transparent response - and I admit I'm heavily biased in favour of (F)OSS.
I've looked (quickly) but been unable to find details on how this was able to occur - do any Slashdot readers know? Could you post or point to the information please.
This is all I could find out:-
We have identified the process which allowed this file to be posted publicly and have taken steps to prevent this in the future. We are also evaluating other processes to ensure your information is safe and secure.
Also - what, if any, steps are being taken to prevent it happening again?
Are any of these users Massachusetts residents. :)
After years of not using a signature, I am going to make one to say the following: Fuck Beta
This is another example of why we need the government (at least here in the U.S.) to provide a single (biometric, if possible) ID and GUID for each user of the internet.
Problems like this one (and Gizmodo's) would simply disappear. You'd never need to memorize a password again, or worry about it getting lost in the wild and causing all kinds of havoc.
As an added benefit, it would eliminate "internet anonymity" so the Internet would become a much safer place. It's obvious we'd be much better off, even identity theft would vanish.
We already have the foolproof technology in place, so why is everyone avoiding it?
The day before this was noticed my Gmail account was hacked by Chinese spammers and I know I used the same password there. So I am skeptical about the claims that no one had downloaded this file. The email only says when they noticed the problem, but doesn't specify how long the file was available before that. It could have been available for a long time.
Seriously, these are the people who are writing a browser, and they don't even know how to create a secure infrastructure. Perhaps they should stop squandering their money on stupid projects and eye candy, and take care of their own house first?
Gawker has its private information stolen, whereas Mozilla just hands it out for us.
It's really convenient to ignore details like australian schoolkids faking fingerprints for the absentee system with gummi bears. Yes, that's right, gummi bears. The basic problem with biometrics is that it is always easier to fake than replace the "identity", meaning that once that data is compromised (replay attack, anyone?) the prudent thing and indeed the only recourse left for the government is to kill you. Is that what you want?
Problems like this and gizmodo won't go away at all, the data in their database will just change. Your needing to memorize a password hinges on availability of biometric- and card readers and supporting infrastructure, software, and such. And of course, anonymity is the source of all evil, despite the fact that the founding fathers made heavy use of it to discuss giving form to the USA. Maybe we should burn all whistleblowers on the stake too, just to be sure. So you admit that you are living in sin in a provably evil country too? Report yourself to the nearest extermination station, citizen. Friend computer knows best.
Urrgh.
Please, don't encrypt passwords. Encryption implies that you can retrieve them if you have the keys, which could have made this much worse.
MD5 hashing is probably still a secure practice, done right, for a given degree of "secure". Like any kind of data security, it's all about raising the cost of obtaining the data beyond the amount that a given person is will to pay to do so. While MD5 costs less to crack these days, the cost to obtain each Mozilla user account password is probably still higher than most are willing to pay (although stealing the resources to do this via a botnet probably reduces this cost considerably).
Given equally sound methodology, encrypting passwords is always less secure than hashing them, because encryption implies that you can retrieve the plaintext, which leaves it open to all sorts of additional attacks, like stealing the encryption keys along with the data, "persuading" the sysadmin to decrypt them with either a rubber hose or a wad of cash, etc, etc.
On the other hand, hashing means that you genuinely cannot retrieve the password without expending a large amount of CPU time, and persuasion isn't going to help.
Any site that will emails you your password as plaintext is doing it wrong - there is no reason that any authentication system should be able to retrieve your plaintext password. It's acceptable to offer a means to force a password change, it is NOT acceptable to send my password to me via a medium that any intervening server could read, and it's not acceptable to be storing passwords as plaintext or even encrypted when it is demonstrably less secure than hashing and there is no benefit to retaining them.
In fact, you should mail the sysadmin of any such system and let him know that his system is doing it wrong, and why.
including email addresses, first and last names, and an md5 hash representation of user passwords."
How long before we see a file on bittorrent?
With plaintext passwords derived from crack MD5 hash representations.
Time to change your password, if you have an account on Mozilla's website. Repeat with any other online resources (such as e-mail accounts or accounts with other websites) you used a similar password on.
I've been using an AJAX email client for the last few years and plan to use (a different) one in the future, seems like a great idea.
"When information is power, privacy is freedom" - Jah-Wren Ryel
This was likely someone doing a classic "select*fromusers" query. Hopefully this doesn't trip the sql injection filters :)
If the hash had been in another table and that table had very restrictive permissions on it then this probably could have been avoided.
The same problem is likely going to occur with databases that are being hit by Ajax calls or through some kind of proxy. If you don't want a column to make it's way out put it in a seperate table/db and restrict everyone but the key DBAs and web servers from it.
I use an algorithm to incorporate some letters from website name into password, thus for each website my password is different. You can shift the letters by one to make them less obvious.
:)
Over the time my algorithm changed a few times to make it less obvious. Also, I use different level of complexity depending on how secure it should be. This created a mess, and I started storing them on my smartphone. However, I only store info what algorithm I used, not the password itself. So, should I lose my smartphone, the passwords are still relatively safe.
Hope this helps and I don't get hacked after giving it all away
What alternative do you propose? I must have accounts on 100 different websites by now, including this one. I can't create and remember 100 distinct strong username/password combinations on all of those websites. Unless you're an autistic savant you can't either.
Keepass. Clients are available for all major platforms, desktop and mobile. Combined with Dropbox, I can add/change passwords to the database on any system and my other systems are updated. This includes my Android mobile phone. One could implement something similar with rsync or something, I imagine...
Also, consider a common password, but one modified through some easily-remembered scheme. For example, use two words with a number inbetween. Add a letter after the number; make it the second letter in the site's domain name (ie dropbox would be r). Whoever steals thousands or hundreds of thousands of passwords is interested in getting into sites with identical passwords; your password scheme is safe unless they get the passwords to more than one site...even then, you're still a little due to safety in numbers; attackers are still only interested in the easy targets, just like the people who go down the street testing car door handles until they find the unlocked car.
Please help metamoderate.
It only uses clientside javascript to generate passwords for each site based on your one remembered password Sure that means changing the password for every site, but you only have to do that once, then never again need to store passwords. You can even make a bookmarklet to generate the passwords if you get blocked from using that site.
Unless you are internet-ignorant, you don't ever give your real first and last names to websites unless you need to (e.g. your bank or healthcare). Addons is the least likely website to get my real last name.
SuperGenPass is a simple bookmarklet that can generate hashed passwords based on a master password. Like KeePass and LastPass you only need to remember one password, but unlike those, it doesn't store anything and you can use it pretty much anywhere.
Signatures are a waste of bandwi (buffering...)
I run Linux so I am completely safe from this sort of thing(let me get it out of the way for some of you - Whoooosh)
The new right fascists are bilingual. They speak English and Bullshit.
Causes Memory - Google Update plugin that shouldn't be there. (remove this from the directory)
Stability - Google Toolbar poorly coded.
Non-standard directory usage (component directory instead) - Google Desktop Search.
Disable AVG, Norton browser "helper" add-ons.
There performance becomes better. 3.x.x is slow because it's memory usage is low. It has been more memory effective since 3.0, or are you only counting one Chrome process?
Use portableapps.com Firefox 4 beta, don't run it at the same time and you'll see things (like performance) have improved.
You can use Opera instead you know, that would be a little more productive, and there are other organisations to go around on forums about, Facebook is a good example of bad things it has done which affects a lot of people.
Of course there's Safari or Maxthon if the others don't float your boat.
Why does strong authentication require every client to have a static IP/etc?
Current SSL requires the server to have a dedicated IP per hostname, not name-based virtual hosting, because it has to send the certificate before it gets a chance to see the Host: header. It need not for the client because the client already knows what client-side certificate to send for a given host.
The only thing that is missing is getting the private key off of the PC and onto a smart card/etc.
Agreed. I just wanted another chance to remind readers of why HTTP without SSL still exists at all. Another problem is how to get the web site to distinguish between an authentic smart card and a PC that has been compromised to emulate an attacker's smart card.
Least Mozilla actually tell you when something like this happens, I can't count how many times in the past I've heard of credentials going missing and hearing it from a news site and NOT the company. We can still scold them for not being careful but at least they tell us, Mozzila 3.