Chinese Developer Forum Leaks 6 Million User Credentials

gzipped_tar writes "The 'Chinese Software Developer Network' (CSDN), operated by Bailian Midami Digital Technology Co., Ltd., is one of the largest networks of software developers in China. A text file with 6 million CSDN user credentials including user names, password, emails, all in clear text, got leaked to the Internet. The CSDN has issued a letter of apology to its users. In the letter, it is explained that passwords created before April 2009 had been stored in plain text, while later passwords were encrypted. Users created between September 2010 and January 2011 may still suffer from email address leaks. A summary of the most frequent passwords without the corresponding usernames is available at GitHub. Somewhat surprisingly, the cryptic sounding password 'dearbook' ranks 4th with 46053 accounts using it."

Comments

"Who cares" level of password

[Anonymous Coward]

They all seem to be the sort of password I'd type in for an account that I really don't care about, and am only creating because it's mandatory.

Does the site offer/store anything that would be worth the effort of creating a password worth caring about?

Re:'dearbook'?

[BigMattyC]

It is probably a reference to Mao's Little Red Book. http://en.wikipedia.org/wiki/Quotations_from_Chairman_Mao#Images_from_.22The_Little_Red_Book.22

Before April 2009

[tchernobog]

passwords created before April 2009 had been stored in plain text

UPDATE users SET password = SHA1(password) WHERE created_at

There. Did it for you. Won't prevent everything getting stolen, but at least you don't give away any more passwords reusable on other websites.

I mean... seriously?? So you have to check in your code if an account has been created before and after 04/2009, and do different actions to check their credentials upon that? Yuuuck.

Re:Before April 2009

[Ex Machina]

That's cool, but there should be salting. http://en.wikipedia.org/wiki/Salt_(cryptography)

I've never understood clear text passwords

[Anonymous Coward]

It's sooooo easy to md5 a password before doing anything with it. md5 it in javascript and never bother collecting the clear text, is it the most secure ever? probably not. Is it a billion times better than cleartext and unbelievably easy? Yes.

Re:I've never understood clear text passwords

[_0xd0ad]

If the MD5 is all that gets sent, it is the password. If someone gets the MD5 hashes they can log in by hacking the Javascript to send the MD5 without ever having the original password.

Re:I've never understood clear text passwords

[_0xd0ad]

There's nothing wrong with hashing your own password so that someone can't infer "mypassword@sourceforge" from "mypassword@slashdot", but you can't trust a client-side hash function any more than you can trust the server-side authentication, unless it's your client-side hash function.

There's no benefit in designing a login form that hashes the password before it's sent, as long as the form is using SSL. Furthermore, there's no backward-compatibility for people who have Javascript disabled. They can't log in.

Re:some thing to do with dearleader?

[Baloroth]

But that doesn't mean people are ignorant of cultures. English is simply a good language for technical matters, for a large number of reasons. Being the de facto standard is only the most obvious.

Also, I should point out the British invented English, not the US, and they spread it around the world, so I'm really not sure what your point here is. Point of fact, the US probably has more variety of culture than any other nation in the world.