Slashdot Mirror
Online Backup Firm Carbonite Tells Users To Change Their Passwords Now (grahamcluley.com)
Security reporter Graham Cluley writes:Online backup company Carbonite is the latest firm to have issued a warning that hackers are attempting to break into its users accounts, and are prompting all users to change their passwords as a result. An email has been sent to Carbonite users explaining that the attackers are thought to be using passwords gleaned from other recent mega-breaches. "Based on our security reviews, there is no evidence to suggest that Carbonite has been hacked or compromised," the email reads. "To ensure the protection of all our customers and the safety of their data, we are requiring all Carbonite customers to reset their login information."Instructions to assist you with changing your password is here.
"Carbonite Personal online backup protects your most important digital assets, automatically and continuously." see? don't have to worry about hacked passwords.
If there's one thing we should learn from these breaches it's that having to create an account to use a site is generally a dumb thing to do.
Yes, it's unavoidable in some cases, but in other cases there's no reason not to allow Anonymous Coward-style interaction, like Slashdot does.
As we can see from sites like Slashdot, Reddit, Hacker News, and Stack Overflow, supporting or forcing the use of accounts actually reduces the quality of the discussion. Everybody becomes concerned about protecting their "karma" or "points" or whatever they fuck the site calls them, and instead of getting real discussion we often get a pacified, pathetic discourse instead.
Accounts are typically one of the worst things that a web site can support.
Totally agree.
Carbonite is a thing that existed before Star Wars:
https://en.wikipedia.org/wiki/...
With that many password resets going on, how many more accounts will be hacked and be used as stepping stones into even more systems with access to password databases? And then, more password resets? Is there a critical mass?
Maybe they need Apponite?
They told everyone to reset their passwords and strongly encouraged 2-factor authentication.
Just wait until IoT devices are caught collecting credentials. Your IoT-enabled light bulb? Yeah, it turns out it's using its camera to watch you type, and it's recording the sound of your keystokes, and it's using its embedded CPU to analyze and statistically determine your passwords, and it's uploading this info into "the cloud" for gosh knows who to access and use.
Nobody will be safe. It's bad enough that IoT technology will likely be used to watch you in the bathroom. But maybe collecting credentials will finally be what turns people against IoT devices.
There is no such thing as online backup. By definition backup must not be online. Physical presence and offline media is required. http://www.taobackup.com/
I assume so many people doing resets at once, plus the attack itself is why Carbonite is being slow to respond today?
Hi, same AC here. I thought a little bit about what I said and I have changed my mind, websites with accounts are great! Also, I like to eat my boogers.
mod up ^
The hell are you on about? Anonymous discussion is one thing, but accessing my backed-up personal files on Carbonite had damned well better require logging in to my account.
That is possible, but given that this is apparently a backup service, I don't think the explosive meaning is what they were going for.
Ezekiel 23:20
Of course not, but it still prevents it from being trademarked.
Websites should not store users' passwords. It's completely unnecessary. Instead, the registration and login web pages offered by the website should compute a hash of the user's chosen password using JavaScript embedded in the page. This hash should be sent to the web server, which must then store it. If the web server is subsequently hacked, the hackers get hashes of passwords rather than the original passwords. There's no way to recover the original password from its hash. So even if each website user chooses to use the same user id and password across many different sites, hacking one won't allow hackers to log into any of the others using the hacked credentials. An SHA-3 hashing algorithm in JavaScript can be as small as 1624 bytes of code - see blake32.min.js at https://github.com/drostie/sha...
Too bad there's no way to identify a client across multiple postings. Like maintaining a simple HTTP session (and having the "name" be a hash of that session) or creating a name which is a hash of the IP or somesuch.
Few things amaze me as much as Slashdot's aversion to tracking paired with the attitude against AC.
Perhaps you'd like to tell that to Apple?
Or, for that matter, one of the thousands of other companies that have trademarked specific representations of common, pre-existing, words.
If it wasn't already apparent, a word used as a trademark does not have to be a unique or original word, its representation does, so no, the existence of a carbonite explosive or a fictional means of 'freezing' an object inside a carbon block does not prevent a company creating a trademark using the word carbonite.
At least the first backup would easily blow through my monthly quota. Assuming that the backup algorithm used versioning (e.g. rsync), subsequent backups would be smaller.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
This is not the first such incident. See https://apple.slashdot.org/sto... about how easy it is to socially engineer your way into someone else's account. That's why I do not want anything vital "in the cloud"...
* because people can get at your data on the cloud
* GM can shut down your car from the cloud via Onstar
* California now demands that phones "reported stolen" be shut down from the cloud
etc, etc.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user