Slashdot Mirror

← Back to Stories (view on slashdot.org)

Chinese Developer Forum Leaks 6 Million User Credentials

Posted by timothy on from the it's-curtains-for-you-elizabeth-my-dearbook dept.

gzipped_tar writes "The 'Chinese Software Developer Network' (CSDN), operated by Bailian Midami Digital Technology Co., Ltd., is one of the largest networks of software developers in China. A text file with 6 million CSDN user credentials including user names, password, emails, all in clear text, got leaked to the Internet. The CSDN has issued a letter of apology to its users. In the letter, it is explained that passwords created before April 2009 had been stored in plain text, while later passwords were encrypted. Users created between September 2010 and January 2011 may still suffer from email address leaks. A summary of the most frequent passwords without the corresponding usernames is available at GitHub. Somewhat surprisingly, the cryptic sounding password 'dearbook' ranks 4th with 46053 accounts using it."

4 of 102 comments (clear)

  1. Re:'dearbook'? by Anonymous Coward · · Score: 5, Informative

    dearbook.com.cn is a chinese online technical book retailer owned by CSDN.

  2. Re:Before April 2009 by OverlordQ · · Score: 4, Informative

    So you have to check in your code if an account has been created before and after 04/2009, and do different actions to check their credentials upon that? Yuuuck.

    Mediawiki is (re: was) like that. When it changes password schemes it detects which version the pw is stored in, authenticates using that (older) method and then upgrades you to the new format.

    --
    Your hair look like poop, Bob! - Wanker.
  3. Re:some thing to do with dearleader? by cyfer2000 · · Score: 4, Informative

    it's an online book store.

    --
    There is a spark in every single flame bait point.
  4. Re:I've never understood clear text passwords by jabbany · · Score: 2, Informative

    It's sooooo easy to md5 a password before doing anything with it. md5 it in javascript and never bother collecting the clear text, is it the most secure ever? probably not. Is it a billion times better than cleartext and unbelievably easy? Yes.

    Actually, doing MD5 on a client side script is severe no-no if it were the only form of authentication. A hacker could simply run a script running through all 16^32 possiblities of the MD5 hash instead of the almost infinite possiblities of the original password. Doing a client side MD5 actually weakens many passwords instead of strenthening them. You're left with something around an 18 character alpha-numeric-symbol password - no matter how long or difficult your original password was.