Slashdot Mirror

← Back to Stories (view on slashdot.org)

Chinese Developer Forum Leaks 6 Million User Credentials

Posted by timothy on from the it's-curtains-for-you-elizabeth-my-dearbook dept.

gzipped_tar writes "The 'Chinese Software Developer Network' (CSDN), operated by Bailian Midami Digital Technology Co., Ltd., is one of the largest networks of software developers in China. A text file with 6 million CSDN user credentials including user names, password, emails, all in clear text, got leaked to the Internet. The CSDN has issued a letter of apology to its users. In the letter, it is explained that passwords created before April 2009 had been stored in plain text, while later passwords were encrypted. Users created between September 2010 and January 2011 may still suffer from email address leaks. A summary of the most frequent passwords without the corresponding usernames is available at GitHub. Somewhat surprisingly, the cryptic sounding password 'dearbook' ranks 4th with 46053 accounts using it."

9 of 102 comments (clear)

  1. "Who cares" level of password by Anonymous Coward · · Score: 4, Insightful

    They all seem to be the sort of password I'd type in for an account that I really don't care about, and am only creating because it's mandatory.

    Does the site offer/store anything that would be worth the effort of creating a password worth caring about?

  2. Re:'dearbook'? by Anonymous Coward · · Score: 5, Informative

    dearbook.com.cn is a chinese online technical book retailer owned by CSDN.

  3. Before April 2009 by tchernobog · · Score: 4, Insightful

    passwords created before April 2009 had been stored in plain text

    UPDATE users SET password = SHA1(password) WHERE created_at

    There. Did it for you. Won't prevent everything getting stolen, but at least you don't give away any more passwords reusable on other websites.

    I mean... seriously?? So you have to check in your code if an account has been created before and after 04/2009, and do different actions to check their credentials upon that? Yuuuck.

    --
    42.
    1. Re:Before April 2009 by OverlordQ · · Score: 4, Informative

      So you have to check in your code if an account has been created before and after 04/2009, and do different actions to check their credentials upon that? Yuuuck.

      Mediawiki is (re: was) like that. When it changes password schemes it detects which version the pw is stored in, authenticates using that (older) method and then upgrades you to the new format.

      --
      Your hair look like poop, Bob! - Wanker.
    2. Re:Before April 2009 by Ex+Machina · · Score: 3, Insightful

      That's cool, but there should be salting. http://en.wikipedia.org/wiki/Salt_(cryptography)

  4. Re:some thing to do with dearleader? by cyfer2000 · · Score: 4, Informative

    it's an online book store.

    --
    There is a spark in every single flame bait point.
  5. Re:How many people here on slashdot by g0bshiTe · · Score: 4, Funny

    I looked for mine, 1234 wasn't on the list.

    Shit! Now I have to change it. I'll just add a 5.

    --
    I am Bennett Haselton! I am Bennett Haselton!
  6. Re:I've never understood clear text passwords by _0xd0ad · · Score: 4, Insightful

    If the MD5 is all that gets sent, it is the password. If someone gets the MD5 hashes they can log in by hacking the Javascript to send the MD5 without ever having the original password.

  7. Re:I've never understood clear text passwords by _0xd0ad · · Score: 3, Insightful

    There's nothing wrong with hashing your own password so that someone can't infer "mypassword@sourceforge" from "mypassword@slashdot", but you can't trust a client-side hash function any more than you can trust the server-side authentication, unless it's your client-side hash function.

    There's no benefit in designing a login form that hashes the password before it's sent, as long as the form is using SSL. Furthermore, there's no backward-compatibility for people who have Javascript disabled. They can't log in.