Slashdot Mirror
Chinese Developer Forum Leaks 6 Million User Credentials
gzipped_tar writes "The 'Chinese Software Developer Network' (CSDN), operated by Bailian Midami Digital Technology Co., Ltd., is one of the largest networks of software developers in China. A text file with 6 million CSDN user credentials including user names, password, emails, all in clear text, got leaked to the Internet. The CSDN has issued a letter of apology to its users. In the letter, it is explained that passwords created before April 2009 had been stored in plain text, while later passwords were encrypted. Users created between September 2010 and January 2011 may still suffer from email address leaks. A summary of the most frequent passwords without the corresponding usernames is available at GitHub. Somewhat surprisingly, the cryptic sounding password 'dearbook' ranks 4th with 46053 accounts using it."
We really sorry
We no joke
Didn't mean to put pee-pee in your coke.
SJW: Someone who has run out of real oppression, and has to fake it.
The hackers got hacked?
The real Sig captains the Northwestern. This one captains
What does 'dearbook' mean something to the chinese? It sounds like nonsense to a native English speaker.
Clear text passwords - idiots.
good that he is dead
see there own passwords in the list?
* guilty :-(
They all seem to be the sort of password I'd type in for an account that I really don't care about, and am only creating because it's mandatory.
Does the site offer/store anything that would be worth the effort of creating a password worth caring about?
UPDATE users SET password = SHA1(password) WHERE created_at
There. Did it for you. Won't prevent everything getting stolen, but at least you don't give away any more passwords reusable on other websites.
I mean... seriously?? So you have to check in your code if an account has been created before and after 04/2009, and do different actions to check their credentials upon that? Yuuuck.
42.
It's sooooo easy to md5 a password before doing anything with it. md5 it in javascript and never bother collecting the clear text, is it the most secure ever? probably not. Is it a billion times better than cleartext and unbelievably easy? Yes.
1 in 10 accounts uses one of the top 10 passwords. It's still better than iPhone users.
Slashdot - News for Nerds, Stuff that Matters, in ISO-8859-1 Has just realised that beta makes this signature redundant
anyone have alt download link for the list? nice little wordlist to have floating around
The kind of thing an idiot would have on his luggage!
After looking at port scans this morning, I have one thing to say: what goes around comes around. I have a hard time thinking such incompetence as would lead to so many exploited machines is possible without just a little bit of malice.
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
I'm looking at you, Mailman... http://www.list.org/
Yada yada, everything says that you should memorize passwords. In theory each site should have a different one. People have been told forever that they MUST NOT write down the password to anything anywhere, and the corresponding behaviour is to reuse passwords.
It stuck me the other day - given that the scope of online activities and identities seems to increase, but human capacity for good passwords and online security does not, and given common constraints e.g. the assumption that many people will reuse passwords - would it make sense to go back to storing passwords on paper?
I have 3 systems myself:
A very widely used password in the form of a jumble of letters I tweak 2 letters of depending on the name of the website.
A "special" password for a small number of more important sites.
A couple of phrases with a special character in them for encrypted data.
I understand where a lot of the passwords come form but what is the basis for the 18th on the list "xiazhili" What does it mean? I doesn't line up with anything I can figure out like the others
Whew!
My password is waaaaaaaaay down in the 40s!
... for new malware attack vector on daft news readers.
http://dazzlepod.com/csdn/
If this is any indication of the level of security that China has on their exposed systems then I doubt that our security agencies are having any trouble infiltrating Chinese systems.
We've had at least 3 engineers from Chinese companies visit us that put their index finger on 1 and swipe 23456789 all in one motion for their laptop password. I had never seen that before working with the Chinese. Is swiping the keyboard for passwords only popular in China, or do idiots everywhere do that?
in china 6million is just like 0000.6 % of the population so really not that bad:-)
had Become like
lol n00bs in China leakin' ur passwords
english 'iloveyou' is at #26 but the Mandarin for the same is 'wo ai ni' ... 'woaini1314' is at #83. the 1314 means "forever" ... because it sounds like forever when pronounced in Cantonese. At #93 is '5845201314' - when pronounced in mandarin - 'wo fa shi, wo ai ni, yi san yi si'. ... which sounds like - "i swear to love you forever and ever"... More here: http://en.wikipedia.org/wiki/Numbers_in_Chinese_culture#Combinations