TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

MDN Database Disclosure

73 pointsby diegocralmost 11 years ago

9 comments

pllbnkalmost 11 years ago
I have been wondering who leaked my address after I started getting the &quot;E.N.L.A.R.G.E...Y.O.U.R.....&quot; spam exactly about a month ago.<p>Initially I thought that it might have been my fault for entering the email address where I shouldn&#x27;t have. I am disappointed that such processes are even architecturally possible at Mozilla where internal data is exposed externally.<p>Also, this has raised a question. Almost everybody knows that passwords must be hashed and salted. But I haven&#x27;t see anywhere encrypted email addresses. Are there any strongly negative consequences to encrypting sensitive personal data in databases?
评论 #8124465 未加载
mp4boxalmost 11 years ago
Can someone explain the meaning of &quot;data sanitization process of the site database had been failing&quot;<p>Isn&#x27;t that another way of saying SQL injection ?
评论 #8123705 未加载
评论 #8123618 未加载
matugmalmost 11 years ago
I don&#x27;t understand why they had to do this, couldn&#x27;t they just use a schema dump with random data? They are already setting the passwords to null and names to a random number in their sanitization script...
simonsarrisalmost 11 years ago
Emails were just sent out to users, full text: <a href="https://gist.github.com/simonsarris/829ba1c0669c404f0da5" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;simonsarris&#x2F;829ba1c0669c404f0da5</a>
frikalmost 11 years ago
In Dezember 2013, Mozilla MDN switched to their self developed Kuma wiki software (from a hosted wiki solution). An open source wiki software written in Python and using the Django framework. <a href="https://developer.mozilla.org/en-US/docs/MDN/Kuma" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;MDN&#x2F;Kuma</a> , <a href="https://news.ycombinator.com/item?id=6876636" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6876636</a>
评论 #8124824 未加载
sheetjsalmost 11 years ago
The email that was just sent out to MDN users seems to differ from this post. The email says:<p>&gt; Your email address (but not password) was posted on that server for that 30 day time period.<p>There is no other mention of the word password or hash (encrypted or otherwise). However, the post says<p>&gt; in the accidental disclosure of MDN email addresses of about 76,000 users and encrypted passwords of about 4,000 users on a publicly accessible server.
评论 #8123539 未加载
jvehentalmost 11 years ago
tldr: an automated data sanitization process failed, emails and salted hashed passwords were disclosed. no server was hacked.
billyhoffmanalmost 11 years ago
There is much that could be done to improve this announcement:<p>1- What does &quot;encrypted, salted passwords&quot; mean? MD5 with a static salt? Holy shit, that&#x27;s a problem. bcrypt? Less so. I have no context to know how concerned I should be, or any indication of how incompetent, or awesome, Mozilla&#x27;s existing processes and defenses are. Fail.<p>2- They talk about a &quot;data sanitization process&quot; failing, but then talk about a &quot;database dump file&quot; being publicly accessible. Say what? This could mean anything from &quot;an input validation error allow wrong passwords to work&quot; to &quot;we do a regular database dump, and store that on a public HTTP directory for some cron job to grab.&quot; Without explanation, I assume the worst. Fail.<p>3- &quot;While we have not been able to detect malicious activity on that server...&quot; Again, without the context of what happens, this statement is worthless. If you leaked the database of your users, I won&#x27;t expect any malicious activity. An adversary wouldn&#x27;t attack Mozilla. They would crack the passwords of the users and attempt to hijack their accounts on other sites that matter, like, banking or ecommerce sites. At best Mozilla knows this and just wanted to include some proof-point that at least they have logs&#x2F;basic monitoring of stuff in place, and wanted to save face. At worse, Mozilla truly believes that someone not actively attacking them somehow means that nothing bad will happen from this loss, which is stupid. And Mozilla&#x27;s Security usually isn&#x27;t stupid. Fail.<p>4-&quot; In addition to notifying users and recommending short term fixes, we’re also taking a look at the processes and principles that are in place that may be made better to reduce the likelihood of something like this happening again.&quot; This is a completely unsatisfactory statement. If you just discovered the problem this afternoon, like, &quot;oh shit, why is the a .sql dump in our HTTP readable &#x2F;backups&#x2F; folder?&quot; then saying &quot;hey, we discovered a problem, we think we have stopped it, and we are looking into our processes&quot; is a reasonable response. However when you have &quot;just concluded an investigation&quot; you should, I don&#x27;t know, tell us your conclusions maybe? What happened? Why did it happen? What changed in your existing system that allowed it to happen? Or has this short coming always existed? If so, who is defining&#x2F;vetting your processes? What are you doing so this issue doesn&#x27;t happen again? What other thing are you doing to watch the thing that&#x27;s going to make sure it doesn&#x27;t happen again? Instead, we get a generic statement. Fail.<p>While not as completely opaque as some &quot;oh no, we got pwn3d&quot; posts, this blog post has completely failed to do the 3 things any post of this kind should do: 1) educate me about what happened 2) help me understand the risk Mozilla&#x27;s actions have exposed me to, and 3) give me confidence by demonstrating clear actions you are taking so this won&#x27;t happen again.<p>Yes attacks happen, but when a company or organization is up front, honest, and over communicates, it does wonders to calm the situation.<p>Mozilla, I expect more from you.
评论 #8123781 未加载
评论 #8123687 未加载
评论 #8123860 未加载
评论 #8124548 未加载
tomjen3almost 11 years ago
Can we please start making people go to jail when this happens? I am so tired of having personal information so often.