TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Change your Last.fm password

150 点作者 luiperd将近 13 年前

22 条评论

anigbrowl将近 13 年前
Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful industry certification, and on developers' insistence that I use passwords of between X and Y length and containing particular combinations of characters, numbers, etc.<p>Every time I read about one of these avoidable breaches, I feel tempted to gin up a class action lawsuit and force a company to either write a painfully large check to acknowledge the time and trouble it has imposed on its customers - say, about $5 each - or sell itself to its users in lieu of money. I'm not actually going to go to that effort, but sooner or later some enterprising law firm will, and I'm sure everyone here is going to be all hand-wringy about it.<p>We need to automate security and make it customer-centric. It is plainly too complicated to be left to individual web service providers, just as brick-and-mortar stores do not manufacture their own door locks or burglar alarms. Vendors, if you feel you can't safely outsource this job to a third party, then you need to hire full-time security monitors and start facing up to security as a line-item cost rather than a check-box you can forget about after you've put it in place.<p>Sorry to be ranty, but when established firms are losing millions upon millions of passwords literally on a <i>daily basis</i>, something is drastically wrong with the state of the art. This is a problem that can't be prettied away with CSS or smoothed over with a few tweets and blog posts.
评论 #4080613 未加载
评论 #4081772 未加载
评论 #4080605 未加载
评论 #4081095 未加载
评论 #4081035 未加载
jgrahamc将近 13 年前
Is there a cryptanalytic reason why a company that has a database full of MD5/SHA1 hashes can't perform a one time upgrade by computing bcrypt(salt, the_old_hash) for every hash they have in the database and then when someone logs in do bcrypt(salt, md5/sha1(password)) to check the password?
评论 #4081147 未加载
评论 #4081904 未加载
评论 #4080968 未加载
评论 #4081499 未加载
评论 #4081909 未加载
评论 #4080985 未加载
jasonkester将近 13 年前
Last.fm sounds like the canonical example of a site that where it makes absolutely no difference if your password gets exposed.<p>Worst case, some malicious individual on the internet will learn that I still like the Beastie Boys, even though it's not 1994 anymore. And possibly they'll listen to music in my name.<p>This is why one has a throwaway password. For throwaway accounts at throwaway sites like this. Getting your throwaway password thrown away should by definition not be something you worry about.
评论 #4080368 未加载
评论 #4080345 未加载
评论 #4080328 未加载
评论 #4080530 未加载
评论 #4080405 未加载
评论 #4080386 未加载
tptacek将近 13 年前
17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.
评论 #4080092 未加载
评论 #4080298 未加载
hpaavola将近 13 年前
Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.
评论 #4080189 未加载
评论 #4080245 未加载
评论 #4080166 未加载
评论 #4080352 未加载
评论 #4080198 未加载
评论 #4080253 未加载
0x0将近 13 年前
Do LinkedIn, eHarmony and LastFM have any parts of their software stack in common? Same 0day?
评论 #4080374 未加载
评论 #4080181 未加载
评论 #4080323 未加载
评论 #4081076 未加载
jameswyse将近 13 年前
@CrackMeIfYouCan posted this on twitter:<p>A bit of stats on last.fm leak:<p>1) It happened a WHILE ago. 2010/2011<p>2) 17.3 million raw-md5<p>3) 16.4 million cracked. 95% cracked.
评论 #4081062 未加载
评论 #4080729 未加载
评论 #4081024 未加载
tosh将近 13 年前
Holy cow.<p>Apparently reporting the vulnerability to them 5(!) years ago was not enough :/<p><a href="http://discuss.joyent.com/viewtopic.php?pid=139497" rel="nofollow">http://discuss.joyent.com/viewtopic.php?pid=139497</a><p>* Communicate over SSL/TLS (avoids session hijacking scenarios and is a reasonable choice in general)<p>* Hash AND Salt user passwords (we use PBKDF2)<p>Take one day and fix this in your own products &#38; you just saved yourself a major PR disaster in the future :)
georgespencer将近 13 年前
Does anyone have a dump of the hashes?
guelo将近 13 年前
Here's the method I use to manage website passwords: For logins that I don't really care about that much, say last.fm, I use my standard medium-strength 6 character password with a number and a capital letter, something like jfi3Jo. I can remember it because I use it often. For logins that I do care about like my email or bank I salt my base password by inserting three characters from the site's domain name into the front, middle and end of the base password. For example, my login to Hacker News would be yjfic3Joo, where yco from ycombinator.com is added in the front middle and end of the base password.<p>I know it's not the most secure method in the world but I think it is a good compromise between remembering the passwords and providing a unique-per-site decent strength 9 character password. If someone figured out my scheme they could get into all my accounts but in order to figure out my scheme they would have to brute force crack two of my 9 character passwords from hashes from two different sites and then match up the two accounts and compare the differences, that is the risk I currently take.
评论 #4083372 未加载
gioele将近 13 年前
It is OK to suggest users to change their passwords, but shouldn't they stop sending their session cookies over plain HTTP? Session hijacking is now widespread and an easy way to get into non-important accounts and then escalate to more interesting accounts.<p>[1] <a href="https://www.owasp.org/index.php/Session_hijacking_attack" rel="nofollow">https://www.owasp.org/index.php/Session_hijacking_attack</a><p>PS: I'm leaving this comment without any reference to the site name, so I can copy and paste it verbatim in the future; it looks like this kind of breaches will not stop soon.
评论 #4083685 未加载
smsm42将近 13 年前
Looks like passwords need to be replaced with something else, obviously most companies, excluding none, are completely unable to handle them properly. Time for a big disruption.
ricardobeat将近 13 年前
I doubt my new password will be any safer, so I can't really use one which follows my current pseudo-random patterns.<p>I'm now convinced that password managers, with random generated passwords, are the way to go. At least they have a strong incentive to focus on protecting user data. Still scared of not knowing my own passwords, and giving them to a third party, though.
评论 #4086008 未加载
ronnoch将近 13 年前
I was worried for a minute, but I can't actually think of anything a hacker could do with my last.fm account that I care about.
soulclap将近 13 年前
To be 'fair': when Last.fm first launched, md5 was probably 'state of the art'. I mean take a step back, they have been around for like forever.<p>The question is: How would you go on about moving your user database from md5 to a more advanced algorithm? Validate a user's password on log-in and then encrypt it with the new, more secure algorithm?
评论 #4080527 未加载
评论 #4080709 未加载
评论 #4080646 未加载
评论 #4080689 未加载
jyap将近 13 年前
I just changed my password and deleted my Last.fm account. Just because I changed my password doesn't mean a new MD5 hash of my new password won't leak tomorrow. If you can't trust the service, don't use the service.<p>To delete your Last.fm account, go to the "Data" tab in settings. Click on "Delete entire account for user".
sunwatcher将近 13 年前
There's a great deal of room for improvement in password protection, which would make stealing a password very difficult. Some discussion on developments in that front here: <a href="http://news.ycombinator.com/item?id=4047968" rel="nofollow">http://news.ycombinator.com/item?id=4047968</a>
adambyrtek将近 13 年前
News of this kind make me even more glad that I use random generated passwords for every site, with LastPass to manage all of that. (Waiting for a snarky comment about LastPass being supposedly hacked some time ago.)
majke将近 13 年前
And WizzAir keeps passwords in plain text. What can be done to shame them?
reidrac将近 13 年前
Last.fm Password Security Update<p><a href="http://www.last.fm/passwordsecurity" rel="nofollow">http://www.last.fm/passwordsecurity</a>
tthomas48将近 13 年前
Wouldn't I want to keep my last.fm password static lest they leak my new password?
StavrosK将近 13 年前
I saw this in another thread today, and I am <i>never</i> NOT using it again:<p><a href="http://supergenpass.com/" rel="nofollow">http://supergenpass.com/</a>