Slashdot Mirror
Mozilla Posts File Containing Registered User Data
wiredmikey writes "Mozilla yesterday sent an email to registered users of its addons.mozilla.org site, letting them know that it had mistakenly posted a file to a publicly available Web server which contained data from its user database including email addresses, first and last names, and an md5 hash representation of user passwords."
at least they told their users
TFA says that it was the user database of the AMO (addons.mozilla.com) website, nothing to so with the Sync server.
http://blog.mozilla.com/security/2010/12/27/addons-mozilla-org-disclosure/
Active accounts have their password SHA-512 hashed with per-user salt, so they're safe (for a while). However those 44,000 holders of older (and now disabled) MD5 hashed accounts should rush changing their passwords elsewhere, if they have the bad habit of using the same password everywhere...
There's a browser safer than Firefox, it is Firefox, with NoScript
This is really well played by Mozilla. We are witnessing a prime example of crisis-communication. The basic rules are:
- Communicate early (even if you don't have all the facts yet)
- Communicate honestly (even if you're to blame)
- Promise follow-up (as needed)
Performing their crisis-communication this well will probably improve public perception of Mozilla. It will certainly raise the bar for other companies.
I have a photographic memory for numbers. I know almost a hundred of them.
But that doesn't excuse the fact they messed up in the first place. What mozilla have done is plain careless. I know, 'accidents happen' - but I'd rather they didn't and I don't trust companies not to keep making mistakes with user data.
Seems like just yesterday I was deleting my Gizmodo account...
One more reason to (a) use fake names everywhere except your bank accounts and, (b) use a password safe application like KeePassX or LastPass to save unique passwords for every site you visit.
This will minimize your exposure when something like this happens again at another site.
I applaud the timely and transparent response - and I admit I'm heavily biased in favour of (F)OSS.
I've looked (quickly) but been unable to find details on how this was able to occur - do any Slashdot readers know? Could you post or point to the information please.
This is all I could find out:-
We have identified the process which allowed this file to be posted publicly and have taken steps to prevent this in the future. We are also evaluating other processes to ensure your information is safe and secure.
Also - what, if any, steps are being taken to prevent it happening again?
Are any of these users Massachusetts residents. :)
After years of not using a signature, I am going to make one to say the following: Fuck Beta
The day before this was noticed my Gmail account was hacked by Chinese spammers and I know I used the same password there. So I am skeptical about the claims that no one had downloaded this file. The email only says when they noticed the problem, but doesn't specify how long the file was available before that. It could have been available for a long time.
It's really convenient to ignore details like australian schoolkids faking fingerprints for the absentee system with gummi bears. Yes, that's right, gummi bears. The basic problem with biometrics is that it is always easier to fake than replace the "identity", meaning that once that data is compromised (replay attack, anyone?) the prudent thing and indeed the only recourse left for the government is to kill you. Is that what you want?
Problems like this and gizmodo won't go away at all, the data in their database will just change. Your needing to memorize a password hinges on availability of biometric- and card readers and supporting infrastructure, software, and such. And of course, anonymity is the source of all evil, despite the fact that the founding fathers made heavy use of it to discuss giving form to the USA. Maybe we should burn all whistleblowers on the stake too, just to be sure. So you admit that you are living in sin in a provably evil country too? Report yourself to the nearest extermination station, citizen. Friend computer knows best.
Urrgh.
Please, don't encrypt passwords. Encryption implies that you can retrieve them if you have the keys, which could have made this much worse.
MD5 hashing is probably still a secure practice, done right, for a given degree of "secure". Like any kind of data security, it's all about raising the cost of obtaining the data beyond the amount that a given person is will to pay to do so. While MD5 costs less to crack these days, the cost to obtain each Mozilla user account password is probably still higher than most are willing to pay (although stealing the resources to do this via a botnet probably reduces this cost considerably).
Given equally sound methodology, encrypting passwords is always less secure than hashing them, because encryption implies that you can retrieve the plaintext, which leaves it open to all sorts of additional attacks, like stealing the encryption keys along with the data, "persuading" the sysadmin to decrypt them with either a rubber hose or a wad of cash, etc, etc.
On the other hand, hashing means that you genuinely cannot retrieve the password without expending a large amount of CPU time, and persuasion isn't going to help.
Any site that will emails you your password as plaintext is doing it wrong - there is no reason that any authentication system should be able to retrieve your plaintext password. It's acceptable to offer a means to force a password change, it is NOT acceptable to send my password to me via a medium that any intervening server could read, and it's not acceptable to be storing passwords as plaintext or even encrypted when it is demonstrably less secure than hashing and there is no benefit to retaining them.
In fact, you should mail the sysadmin of any such system and let him know that his system is doing it wrong, and why.
including email addresses, first and last names, and an md5 hash representation of user passwords."
How long before we see a file on bittorrent?
With plaintext passwords derived from crack MD5 hash representations.
Time to change your password, if you have an account on Mozilla's website. Repeat with any other online resources (such as e-mail accounts or accounts with other websites) you used a similar password on.
I've been using an AJAX email client for the last few years and plan to use (a different) one in the future, seems like a great idea.
"When information is power, privacy is freedom" - Jah-Wren Ryel
No, it isn't
"Give a woman two glasses of wine and some pad thai, and they'll agree to just about anything." the Sports Guy
This was likely someone doing a classic "select*fromusers" query. Hopefully this doesn't trip the sql injection filters :)
If the hash had been in another table and that table had very restrictive permissions on it then this probably could have been avoided.
The same problem is likely going to occur with databases that are being hit by Ajax calls or through some kind of proxy. If you don't want a column to make it's way out put it in a seperate table/db and restrict everyone but the key DBAs and web servers from it.
What alternative do you propose? I must have accounts on 100 different websites by now, including this one. I can't create and remember 100 distinct strong username/password combinations on all of those websites. Unless you're an autistic savant you can't either.
Keepass. Clients are available for all major platforms, desktop and mobile. Combined with Dropbox, I can add/change passwords to the database on any system and my other systems are updated. This includes my Android mobile phone. One could implement something similar with rsync or something, I imagine...
Also, consider a common password, but one modified through some easily-remembered scheme. For example, use two words with a number inbetween. Add a letter after the number; make it the second letter in the site's domain name (ie dropbox would be r). Whoever steals thousands or hundreds of thousands of passwords is interested in getting into sites with identical passwords; your password scheme is safe unless they get the passwords to more than one site...even then, you're still a little due to safety in numbers; attackers are still only interested in the easy targets, just like the people who go down the street testing car door handles until they find the unlocked car.
Please help metamoderate.
SuperGenPass is a simple bookmarklet that can generate hashed passwords based on a master password. Like KeePass and LastPass you only need to remember one password, but unlike those, it doesn't store anything and you can use it pretty much anywhere.
Signatures are a waste of bandwi (buffering...)
I run Linux so I am completely safe from this sort of thing(let me get it out of the way for some of you - Whoooosh)
The new right fascists are bilingual. They speak English and Bullshit.
Why does strong authentication require every client to have a static IP/etc?
Current SSL requires the server to have a dedicated IP per hostname, not name-based virtual hosting, because it has to send the certificate before it gets a chance to see the Host: header. It need not for the client because the client already knows what client-side certificate to send for a given host.
The only thing that is missing is getting the private key off of the PC and onto a smart card/etc.
Agreed. I just wanted another chance to remind readers of why HTTP without SSL still exists at all. Another problem is how to get the web site to distinguish between an authentic smart card and a PC that has been compromised to emulate an attacker's smart card.
Least Mozilla actually tell you when something like this happens, I can't count how many times in the past I've heard of credentials going missing and hearing it from a news site and NOT the company. We can still scold them for not being careful but at least they tell us, Mozzila 3.