Slashdot Mirror
Alleged Massive Account and Password Seizure By Russian Group
New submitter Rigodi (1000552) writes "The New York Times reported on August 5th that a massive collection of stolen email passwords and website accounts have been accumulated by an alleged Russian "crime ring".
Over 1.2 billion accounts were compromised ... the attack scheme is essentially the old and well known SQL injection tactic using a botnet. The Information has been made public to coincide with the Blackhat conference to cause a debate about the classic security account and password system weaknesses, urging the industry to find new ways to perform authentication. What do Black Hat security conference participants have to say about that in Vegas?
For those inclined to make moral equivocations between the NSA and the Russian government, both do what the NSA got caught doing. The difference is that the US Government would have the FBI kicking in this gang's door with a SWAT raid if they were Americans, whereas Putin is probably chuckling right now if he's reading about this.
How was this even possible? Passwords should NEVER be something you can steal since they shouldn't actually be stored as clear text (or even encrypted, for that matter).
Hasn't it been common practice, for at least a decade, to store the passwords as a salted hash (using a unique salt for each user)?
You shouldn't be able to steal a password since the site shouldn't have it.
How do we know they are mutually exclusive of each other?
This story seems to have no actual meat to it. They say that a lot of sites have been hacked, some big names, we knew this. Many sites are still vulnerable, we knew this. By not disclosing the sites you're making more people vulnerable, and it's bad for everyone. It's going to take something bad happening to someone to learn the importance of password security for themselves. Some people will never learn certain concepts unless they experience them for themselves.