Slashdot Mirror
Kickstarter Security Breach Exposes Customer Data
New submitter jbov writes "Kickstarter members received an e-mail at about 16:40 EST notifying them of a security breach. According to the e-mail, information including user names, encrypted passwords, mailing addresses, and phone numbers may have been revealed. Kickstarter members were urged to change their passwords. 'Older passwords were uniquely salted and digested with SHA-1 multiple times. More recent passwords are hashed with bcrypt.' Kickstarter claims that credit card information was not accessed during the breach. According to Kickstarter, law enforcement officials contacted the company on Wednesday night and alerted them that 'hackers had sought and gained unauthorized access to some of our customers' data.' Upon learning of the breach, Kickstarter closed the security breach and began strengthening security measures."
I guess Kickstarter failed to use APK's hosts file.
I'd say your scenario is... unlikely.
they did the right thing and contacted all the people who use KS and advised them to change their login. Unlike Adobe who still haven't contacted me....... With influence comes responsibility - KS has taken responsibility, Adobe never did.
Considering they have been doing exactly what the OP describes for years, why would you lie to defend them? I guess you support their attacks on Kickstarter. That's the only logical explanation I can think of as to why you're defending such dishonest actions. You, and your fellow CONservatives, stand to gain something from its destruction and the persecution of their investors.
Kickstarter stores information about Amazon accounts and the like, too. This could be pretty serious.
AND, they should be held legally responsible. Really, as a society we have to start doing that.
Hmm. I have a Kickstarter account, but I haven't gotten a notification email, so far.
Or perhaps the person is simply ignorant of any evidence to support such claims which you apparently seem to possess in such abundance. I actually haven't seen anything to support it either, for that matter, so from where I sit, the allegation strikes me more as being an unprovable conspiracy theory, and I would consider the notion as improbable as well.
Suggesting that someone who simply disbelieves a criticism must somehow be lying to protect them is even at best a variant of ad-hominem, and at worst, indicative of a possibly less than clear grasp of what is actually real and what is not.
File under 'M' for 'Manic ranting'
Welcome to the decade where big corps realize they can't skimp on security anymore because it costs the banks more time and money to issue cards, and that raises rates for everyone else.
you sound like a faggot.
You sound like you masturbate to Bea Arthur.
What does this mean for Star Citizen funders? lol
Seven puppies were harmed during the making of this post.
Why are we not using public private key infrastructure for online logins yet????? It's 2014, most people have been online for nearly twenty years and human beings are still using passwords that have to (generally speaking) be memorized which leads to poor password choices and repetition. This problem should have been solved YEARS ago.
Beta, you say?
I think you are using beta the wrong way...
Encrypted passwords, how? Do they mean salted and hashed, if so, then the summary should say so.
...I thought the lyrics was "you're a pal and a confidant"
As someone who masturbates to Bea Arthur, don't group me with that asshole.
From what I've been able to understand from communication with Kickstarter and from their mail, the passwords weren't individually salted.
Storing encrypted passwords without salt should get whoever's responsible for their security FIRED. That's truly a rookie mistake. Why? Because it's vulnerable to dictionary attacks.
Kickstarter was nice enough to require you to use email as your login!
and your email address
and your phone number
and your mailing address.
Thank you for being a part of Kickstarter.
Still waiting for the email ...
Here in the land of Kraut and Wurst we had soemthing called "TAN List" in the past. Simply a sheet of paper with one-time-passwords. We used that to confirm banking transactions.
Very easy to make this scheme very secure. Why do we need electronic gadgets with half-baked security mechanisms ?