Slashdot Mirror
Database Leak Exposes 3.3 Million Hello Kitty Fans (csoonline.com)
itwbennett writes: "A database for sanriotown.com, the official online community for Hello Kitty and other Sanrio characters, has been discovered online by researcher Chris Vickery," writes CSO's Steve Ragan, who was contacted about the leak Saturday evening. The database houses 3.3 million accounts containing records including first and last names, email addresses, unsalted SHA-1 password hashes, password hint questions and their corresponding answers, along with other information. The database also has ties to a number of other Hello Kitty portals.
=(^.^)= Kawaiiiii!
What website is there with security that can't be penetrated?
Don't consider things online to be safe.
"First they came for the slanderers and i said nothing."
Can Has Hashtags.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
This is the first leak I have seen where the password hint questions are leaked too. Will be interesting to see how users in the real world link passwords and password hints, and if algorithms can be developed to uncover 99% of all passwords/answers from password hints -- I presume many password hints contain the answer or substantial parts of it (e.g. "pass + 123" = "pass123").
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
"...unsalted SHA-1 password hashes..."
Well, of course they're unsalted. Sodium is bad for Kitty.
"...password hint questions and their corresponding answers..."
Oh holy shit on a popsicle stick, I wonder how many of them aren't about cats...
Another reason not to buy the Hello Kitty microwave oven at Fry's Electronics.
... that their secret may now come out. Oh, well, it could be worse - it could've been a My Little Ponies site.
#DeleteChrome
Step 1. Lay off the sysadmin, the DBA, the network admin, and the developer
Step 2. Hire a "full stack developer" and pay him one below-market salary to do 4 peoples' jobs at once
Step 3. ???
Step 4: PROFIT!!!
Goodbye Kitty
Table-ized A.I.
Everything happens to me.
You are welcome on my lawn.
Quick Lil'Joe...to the Pentagon!
Maybe you lucked out from the Ashley Madison fiasco, but if your name is on this list, exposure may cost you more than you know.
Belonging is important. Saving money, aka spending fewer dollars on stuff you would not buy at full price, is as euphoric as drugs.
So many other reasons. Give it some thought and come back. I'm sure you can come up with one or two more.
You are in the minority, and it would serve you well to understand a bit about "these people".
Belonging is important.
Maybe to you - but not to me.
it would serve you well to understand a bit about "these people".
No! I will not lower myself to that level.
You are in the minority
Thank you! And I am proud of that fact!
Bad Badtz Maru...
Belonging is important.
You have pointed out one of civilization's biggest problems - besides a few others.
People are afraid.
People are afraid of being alone; afraid of not fitting in; afraid of making decisions for themselves by themselves.
Which is the main reason for "social media" and "amazon reviews", etc.
Why do people sign up for every website they come across?
This is a website about some japanese cat for crying out loud.
Why do people sign up for something like this? I guess it's the same people who sign up for safeway cards, starbucks cards and other discount cards.
I just don't get it.
You go into the store, you buy the shit you want and you leave. Just leave it at that for crying out loud. What's wrong with these people?
Yeah, why oh why do people sign up for a site like slashdot, especially when one could do it anonymously?
This is a website about "news for geeks" for crying out loud.
Why would MadMaverick9 sign up for something like this? I guess it's the same people who sign up for engadget, arstechnical and reddit.
I just don't get it.
You go to the site and read the articles and leave. Just leave it at that for crying out loud. What's wrong with MadMaverick9?
It would probably be more damaging to one's career - certainly as a hard talking politician - to be found on the Hello Kitty fan club's name list, than any revelations about drug taking, sexual deviancy or Communist sympathies. Ant chance that there were names of top terrorists among them?
I always found this "password hint" thing a huge security hole, sacrificing the bit of security there is in a user-chosen password for the benefit of the "service" provider.
For me, the simple password is (for unimportant things) always the result of "pwgen -n 8". My favorite's pet name is the result of "pwgen -n 16", which I write down if my account is in some way important to me (highly unlikely for one having a password hint) -- or which I forget right away.
Lost the password? lost the account. Helps me keeping independent.
You had me until Starbucks cards; as a stored value card they are great. The account also has value in being able to pre order your drinks. Everything is relative, but whatever.
When the mod system came in and AC comments were modded down it was time to sign up. Then when I forgot the password and had the account linked to a previous work address I signed up again. What's your excuse :)
The thing that will suck the most here is a pile of those users will have the same passwords out there on something else.
Script kiddies with Hello Kitty Rainbow Tables - if someone had taken that to an SF editor a while ago it would have been thrown out as too silly and too far fetched - but now it's probably real!
now the poor cat has to go back to her day job.
Table-ized A.I.
I am so curious to learn who is behind the user name "Anonymous Coward". He is such a prolific, sleepless contributor...
I THINK, THEREFORE I'M CUTE
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
can you imagine the kind of money you can raise tapping a market that 1 Cute 2 has poor impulse control 3 tends to have access to large sums of money? (oh thats right you can just look at the Sanrio tax filings [just remember to account for all the divs])
...there is only war.
It's difficult to convince many managers that prevention is worth it. They are probably lied to by vendors and past staff enough such that they only pay for clear-cut and immediate needs rather than hard-to-verify prevention.
A lot of vendors and spinner employees claim crap like, "Oh, you need to purchase/build/install a Flux capacitor to prevent the thibble-bop from overloading and crashing the dookitron." After being burned a couple of times, they don't pay even for legitimate prevention because they cannot tell the difference, and so skip ALL prevention.
It's a problem that plagues many forms of technology and infrastructure, such as building construction, plumbing, car repair, etc. The end user cannot easily verify prevention claims.
Yes, one can google around for advice, but it could take several hours to absorb it, and still require specialized experience to evaluate. Time is money for businesses.
If it's the main line of business (primary source of profit), then managers usually know what to look for. However, if it merely supports the main line of biz, such as retail and character licensing in this case, then they are typically unfamiliar with it and skeptical.
Table-ized A.I.
Spartacus can kick your anonymous ass
Table-ized A.I.
Have you seen a language that includes it's own native login system?
If I have been able to see further than others, it is because I bought a pair of binoculars.
Just imagine, all the possibilities, with this information.
For fucks sakes how did this submission get accepted?
- Dan
To be fair though, nearly all the recent mass shooting were done by despondent loners. I prefer my people buying useless crap and hanging out on Rule 34 then gunning down innocents.
... than being on the Ashley Madison list. The Hax0rs have gone too far this time!