Slashdot Mirror
Formspring Hacked - 420,000 Password Hashes Leaked
wiredmikey writes with news of yet another business suffering a data breach. From the article: "Formspring, the Social Q&A portal ..., admitted to being breached on Tuesday. The compromise led to the loss of 420,000 passwords, forcing the site to reset all member passwords. Mirroring the recent LinkedIn breach, Formspring said that it was alerted to a forum post that contained 420,000 password hashes. Engineers shutdown the service and confirmed the passwords were indeed theirs. In less than a day, an investigation revealed that the attacker(s) had 'broken into one of our development servers and was able to use that access to extract account information from a production database' .... There have been no reported incidents of individual account compromise, but there were reports of Phishing by some users on Twitter attempting to capitalize on the incident."
420,000? Is that like 100,000 people smokin' the reefer?
When are people going to get a clue and do proper network isolation of servers ... especially Database servers. There should be no way to attach to a database from outside network. Production and testing servers should all be on sandboxed networks that don't touch the outside.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
And once again we are reminded that using the same password on every site is a terrible idea for just this reason. I know I'm guilty of recycling a generic password on sites I don't care about, but I fear that my family members are even worse. I'd say there's an 80% chance that my family recycles the same password on both social and banking sites.
It doesn't help that many password validation routines choke on spaces. Being able to use a passphrase is way easier than trying to remember some random group of characters that just happen to have a high entropy. The Correct Horse Battery Staple model is my new favorite for any site that will accept spaces. Sadly, one bank that I have done business with won't even allow a password that is more than 8 characters and only accepts letters and numbers. They try to shore this up with some bogus security questions on the following page, but I don't feel really "secure."
What other password strategies do you all use to make sure you keep reasonably secure? I eventually gave in to using KeePass to keep my less frequently but more important passwords secure.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
Whilst I agree with all of the above, I think the *real* takeaway from this should be "don't use shitty websites like Formspring, for fuck's sake."
Personally I much prefer serves like pwdhash.
Remember one base password across all sites and it'll convert it into a hash for you, so even if you have a key-logger installed it'll only record the base, and not the hashed one.
I know it's a Q&A site, but ForumSpring Engineers really shouldn't have answered the question, "How do I hack the ForumSpring servers?"
So, if I understand the idea correctly, once the keylogger has the base password, all derived passwords are screwed? It protects against hash/unencrypted password leaks, but makes the base password too valuable.
It sounds like bad configuration management. I'm guessing the database passwords are the same for the dev servers as they are for the production servers. Bad, bad, bad...
Yep, I love pwdhash. It's portable without worrying about leaving a password database on a thumbdrive or in the cloud, it can generate long, site-unique passwords while using the same base password. Pwdhash is pretty nice in that it is sensitive to stupid websites that don't allow special characters, too - if you put a special in the password you supply, it very likely (but not necessarily) include one in the password it generates. If you don't put specials in the user-supplied portion, the output is just alphanumeric. Of course, there are still the stupid websites that want passwords to be 12 characters or less, and/or have to start with a letter, and/or other asinine rules. A downside though is that there is a maximum length for the passwords pwdhash generates, 22 chars if I remember correctly, but at this point, I don't think that's really an issue.
Still don't recommend actually using the same base password for everything, of course.
The other cool thing about pwdhash (and potentially, similar services too) is that they don't have to be used on websites. You can use it to generate passwords for, say, your wireless. Do something like the SSID in place of the website, then supply your part of the password.
Pwdhash
I vote based on politicians' actions, unless contrary to my preconceptions. Often wrong, never uncertain. #iamthe99%
I know I'm guilty of recycling a generic password on sites I don't care about, but I fear that my family members are even worse. I'd say there's an 80% chance that my family recycles the same password on both social and banking sites
I have one password for each class of security. Ultra critical life savings depends on it has one which is only used on two sites anyway. Then there's /. and sites like it which has another "I can't lose money, but I'd be pissed if someone stole my account" password. Finally "I can't believe these morons force me to create an account for their cruddy site F those idiots the password for moron sites is password123"
I believe that websites that demand account creation when there is no need to create an account, like to order stuff, or view pages, are a social disease that should be stamped out. Aggressively if necessary. Not because one POS automotive parts site demanding I "create an account" just to make a single item purchase one time in my life is inherently evil, but because making a billion people make hundreds of accounts each, many of which will be stolen IS evil. This is no different than the argument where "if I occasionally accidentally dump out a little used motor oil its no big deal, but if the whole planet dumped all their used oil, it would be a freaking disaster"
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
I hav signed up to 280 websites, about 20% I still use, so around 60 websites. Do you think I am really going to use 60 different passwords?
All of my banking passwords are the weakest ones. Most of the banking sites will not allow a full alphabet of special characters (American Express only has something like 6 different special characters you can use). I'm like WTF, is this a banking site or not?
Hey me too! Except at the top level (e.g. banking, email), every site has a unique password. At the lowest level, all the forums and miscellany have the same password.
People need more useful advice then this, because "use different passwords everywhere" is so impractical for most of the public that it's ignored.
More and more I don't think smaller websites like this should even store passwords. Use external authentication providers like Facebook or Google accounts instead. We've seen too many cases where companies that aren't huge don't have security that can stand up, and given budget they never really will.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
At least its hashes and not a clear text file like a certain video game system we all know and love.
You say things that offend me and I can deal with it. Can you?
Were the hashes created with salt, randomized per user? It sounds like they were, which of course is in contrast to the LinkedIn breach.
They didn't "shutdown" the service. They "shut down" the service.
Spelling and grammar matter. Illiteracy is for boobs.
Some time ago I tried to remove my formspring account, but I could not. Online help says "use settings->disable", which leaves my account in "disabled" state. And apparently, my password is still kept. Now, they say "but we leaked your password". I went to the site, logged in, and then it said "please change your password". So apparently they still know my personal data, and even after the leak, I STILL cannot remove it.
That is utterly stupid. They should burn in hell.
Many also had layers of load balancers that were grouped with the web servers, or sometimes with firewalls between the two.
In the development environment you can have the same configuration, with each layer accessible as necessary. Average internal users access at most the network the web servers are on. Developers will have access to all but the database (which is still behind the innermost firewall). DBAs will have access to the network beyond the innermost firewall. The cracker might get into the front end web servers/caching servers, from which they could crack the outermost firewall to allow easier access, but to get through the next requires exploiting another/different bug to get into these servers before they can crack and reconfigure that firewall. Then a quality DBA won't allow any direct access to your users tables from any user that can access the database through the firewall (which will be compromised if the next layer above is compromised), restricting it exclusively to stored procedures that insert, validate, or delete user records (You cannot simply dump the users table(s). A DBA worth his salary should have wrapped everything even slightly sensitive in stored procedures and disallowed direct access to the tables to the users, in fact.) Even the internal company network should only access the database though the innermost firewall (and that network should have no access to internet-facing production servers or the application servers).
As mentioned above, production data should never be used for development database servers (except when specific data is isolated that results in errors, then that alone should be moved into development for debugging).
There's no excuse for the theft of production data to anything short of a rouge DBA and/or physical security failures.
The best part about the security questions is the answers are easy to find (in general). What's your mother's maiden name, where were you born, etc are many times easily available. When I have to use those, I pick something totally different from the true answer. Then it doesn't matter which security question I have. I do record them in my password database though :)
[John]
Shit better not happen!
The "identity sites" have different password model vs a same password. They are associated with me and my information. It would blow if my account started spamming 5 or 6 forums that I use.
[John]
Shit better not happen!
Sure, why not. Most of the time they're saved in your browser password keeper anyway. I have a similar number of accounts with different levels of passwords. For the 200 or so that I don't go to often, I just check my password database. Not a big deal. I periodically roam through the browser db to make sure I have all mine in the pwdb up to date.
[John]
Shit better not happen!
I use Keepass and love it but, given that I use the generate function for passwords, I am now totally dependent on it - along with relying on the browsers to remember the more common non-banking passwords. Given that even my backups are at the same site (home), I really need to finally get a bank deposit box, but I balk at yet another bill.
The dropbox guys made a password strength tool based on that comic (see http://tech.dropbox.com/?p=165).
There is a demo (though it is very raw and not for end users) here: http://dl.dropbox.com/u/209/zxcvbn/test/index.html
at least my 3 common passwords (I share them for "low security risk" sites) score a 4 on it
Because I for one had never heard of this site before now. Just went to the website to see what it was about and for the life of me I can't figure out its use. So you post opinions about stuff? Is that like Twitter but without the character limit? Or a blog post but not as hard (and you can spunk one out on your cellphone instead of having to actually compose your thoughts and form paragraphs)?
If publicizing the hack was to draw some attention to their name, then they've succeeded.
fCb1234, aMz1234, cMs1234, pBb1234, and so on. Last four digits are the same but the first three (and sometimes four) letters are different. First letters relate to the website it belongs to, and the last digits are random. Hasn't failed me yet.
Start using OpenID
AccountKiller
We all tend to get focussed on the publicly release data, but this is just a proof point. Chances are high that much more information is being bought and sold from this breach right now. We'll all debate salted, hashing, protocols and forget just how much was information was included in plain text.
Seeing all the leaks everyday on Should I Change My Password, we've still got a long long way to go. We see thousands of records everyday, with levels of detail that are un-nerving sometimes.
Added that algorithm to my cracker. Thanks!
Once the keylogger is on your machine, all passwords are screwed anyway. As is your CC#, billing address, name, CCV2 code, etc.
Not a sentence!
Hasn't failed me yet.
Except now when you told publicly everyone about it.
In Finland (probably in many other nearby countries too), for banks it's customary to get a printed sheet of one-time tokens mailed at home. There is usually also an extra verification step when you are about to perform some action such as making a transfer.