![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Privacy Privacy](http://a.fsdn.com/sd/topics/privacy_64.png)
![The Internet The Internet](http://a.fsdn.com/sd/topics/internet_64.png)
Wikipedia Leaks Some Users' Passwords 238
JJ Budion writes "If you've signed up for an account on Wikipedia.org, you may want to check this page to make sure you're not on there. It seems certain users with identical password hashes can find other user names with the same password, and Wikipedia (despite being alerted) has done nothing about the problem for the last year. A good (although slightly inflammatory) description of the problem can be found here. This is probably a good occasion to remember to use strong passwords (apparently only users with common passwords, like dictionary words, are affected)."
A few points (Score:5, Interesting)
From the looks of a few of the lists (RickK, RíckK, RìckK, RiÄkK, RïckK, RiÄkK; Mäximus Rex, Maximus Rex, MaximusRex; JíangSlumDawg, JiangFlungDung; LlortTheehtTroll, LlörtTheehtTröll; The Two Trolls,The Fellowship of the Troll,The Return of the Troll,The Trolls of Navarone,Troll Silent, Troll Deep,The Trolling Stones, RangelaND Visa CONtroll), it would appear that some of these are indeed obvious duplicate accounts (whether or not they're "trolls" is, I imagine, beside the point).
But it seems that he also caught a bunch of innocent folks who just happen to share the same password, not beyond the realm of comprehension for a password used for an "online" non-financial, non-critical site on a service with thousands of users. The submission makes it seem like Wikipedia knew about some kind of "exploit" and did nothing; rather, it seems like Wikipedia is content to let potential, and indeed confirmed in one case as admitted on the page [wikipedia.org], abuse of innocent users' privacy continue in the name of exposing possible (admittedly annoying) trolls. (That's my own take on the situation, anyway.)
Interestingly, Wikimedia's (draft?) Privacy Policy [wikimedia.org] says:
Many aspects of the Wikimedia projects community interactions depend on the reputation and respect that is built up through a history of valued contributions. User passwords are the only guarantee of the integrity of a user's edit history. All users are encouraged to select strong passwords and to never share them. No one shall knowingly expose the password of another user to public release either directly or indirectly.
It appears that, in this case, Wikimedia itself is implicitly "knowingly" releasing passwords to the public. One of the many problems with a community site for which there is no central responsible authority. Anyone who hasn't yet would do themselves well to read the summary of the issue [slashdot.org] linked in the submission.
Check your facts (Score:2)
Re:Check your facts (Score:2)
2. I know exactly what the impetus was, as I stated specifically numerous times in my post. That still doesn't excuse overly
Re:Check your facts (Score:2)
Would you care to identify a single innnocent person caught up in this? I thought not. I'll let you get back to your baseless inflammatory ranting now.
Re:Check your facts (Score:2)
Re:Check your facts (Score:2)
Re:Check your facts (Score:2)
Re:Check your facts (Score:2)
Also, I did some quick checks, and it appears there are some non-trolls on the list, e.g. User:Perrak.--Eloquence* 19:28, May 31, 2005 (UTC)
Given that you've found at least one non-troll on the list, I think the privacy concerns mentioned on Slashdot have been well validated. It's not just theoretical, it's real. I'm just astonished to find out that something like this happened here, and I'm more than a little bothered by the fact that everyone seems to keep apologizing for this danger
Ok, so let me get this straight (Score:2)
Re:Ok, so let me get this straight (Score:2)
Front page slashdot story? No, definitely not.
Re:Ok, so let me get this straight (Score:2)
Given that the page will not be updated and there are no active users on it whose privacy has been compromised, why do you persist in branding this an ongoing activity?
Re:Ok, so let me get this straight (Score:2)
And this merits a slashdot front-page story?
Not to mention a couple of hundred comments from trolls saying, "See? I told you Wikipedia would never work! They need to make a lot of changes if they want to be considered professional. I'm so snooty I could never contribute to a project like this!
It's a slashdot tradition, now.
Re:Check your facts (Score:2)
accusing the author of trolling to distract us (Score:2, Flamebait)
No, it's a developer using an "ends justifies the means" argument to catch sock puppet accounts created by people too stupid to assign them unique passwords.
Unfortunately, he didn't think "gee, this might catch some legitimate users off guard", and as a side effect, we see that Wikipedia developers didn't
Re:accusing the author of trolling to distract us (Score:2)
Re:accusing the author of trolling to distract us (Score:4, Insightful)
Frankly, I don't care if they rape nuns, kill puppies for sport, and eat kittens for breakfast. You should not compromise security, even this trivially, for any reason.
If you were so stupid as to use a common word for a password and couldn't even be bothered to do something like change it to "pass45word" then you deserve whatever happens.
It's Wikipedia, not Amazon or PayPal. Most people don't care enough to use a strong password.
Re:still... there's a better way to store password (Score:2)
(Purists always hate it when I say something like this. Oh well.)
Re:still... there's a better way to store password (Score:2)
Also, from the queue on K5, this article might just be the death squirms of the nailed troll(s) anyway.
Well, good for me! (Score:5, Funny)
Re:Well, good for me! (Score:2)
Ju
Re:Well, good for me! (Score:2)
"TheCowJumpedOntoMyMotherInLawAndCrushedH
Re:Well, good for me! (Score:2)
Re:Well, good for me! (Score:2, Funny)
Re:Well, good for me! (Score:2)
1.....2....3...4..5.
I mean doesn't eveyrbody use three periods in between their numbers?
Re:Well, good for me! (Score:2)
Those are the sorts of passwords I assign to people as well when they forget passwords (I'm not normally in a role of resetting passwords, but I have a few apps where I'm the gatekeeper). Gives people an incentive to change them.
If you're a troll on Wikipedia, (Score:5, Interesting)
Additionally, every single post I've seen associated with this looks like someone just looking to drum up trouble for Wikipedia. Look at the list, and you'll notice that a lot of them, yes, are copies. And if they're not copies, you should have used a better password anyways, there's not even numbers in those... On top of that, the developer in charge of that little page seems like quite a decent fellow.
Shame to you for not editing that summary a bit.
Re:If you're a troll on Wikipedia, (Score:2)
Re:If you're a troll on Wikipedia, (Score:3, Informative)
Those aren't passwords. Wikipedia hashes the passwords. The titles are the name of one user in each group. The summary's assertion about strong passwords is irrelevant; the only thing they compared was the password hashes.
Re:If you're a troll on Wikipedia, (Score:3, Insightful)
Just get this into your head: no passwords have been leaked! If two of the accounts in each section where not created by the same person, then the password would be compromized (the other person would know it's the same as his/her own). But that's the only problem.
My guess would be that this would be true for at most two pairs of accounts on that page. Bit probably, none at all.
Re:If you're a troll on Wikipedia, (Score:2, Insightful)
My guess would be that this would be true for at most two pairs of accounts on that page. Bit probably, none at all.
All depends on how smart/mischievous the vandals were. If the
Re:If you're a troll on Wikipedia, (Score:3, Insightful)
Wiki-passwords? (Score:5, Funny)
I've said it before (Score:2, Funny)
"News"? (Score:5, Informative)
Um...didn't this happen like a year ago?
Re:"News"? (Score:2)
Cheers,
-- RLJ
Re:"News"? (Score:2)
Shame on Wiki (Score:4, Insightful)
If, in the long-term, Wikipedia's image is tarnished by this, it is well-deserved.
Re:Shame on Wiki (Score:2)
Re:Shame on Wiki (Score:2)
You don't understand. This list is a year old. If there was anybody on it who wasn't a troll, that's been long since fixed.
My guess, since you seem so emotionally vested in this (judging by your multiple comments on this thread) is that you are one of the trolls in question. Of course, you already know this, so I'm just mentioning it for the other readers out there.
Re: (Score:2)
Re:Shame on Wiki (Score:2)
You weren't on there, were you?
Re:Shame on Wiki (Score:2)
Name one innocent user whose password was compromised in that YEAR OLD list.
Perrak does not count as he is not an active user.
Get over yourself.
Why am I feeding the troll?
Re:Shame on Wiki (Score:2)
So shoddy security practices are okay so long as the compromise remains potential only?
Re:Shame on Wiki (Score:2)
Given that the developer involved agreed that this would be shoddy security if practiced on a regular basis, apologized, and has agreed not to make such a list any more, I'd say we're fine.
If anything, this should have been an uproar a year ago.
Re:Shame on Wiki (Score:2)
I can't believe you, either, but it has made for an enjoyable afternoon of entertainment.
Re:Shame on Wiki (Score:2)
Re:Shame on Wiki (Score:5, Funny)
If they're going to succeed in portraying Wikipedia [wikipedia.org] as a mature, reliable [wikipedia.org] alternative to traditional [wikipedia.org] encyclopedias [wikipedia.org], they ought to make damned [wikipedia.org] sure that their ducks [wikipedia.org] are in a row [wikipedia.org]. Their disregard for customer [wikipedia.org] concerns [slashdot.org] is shameful. [wikipedia.org]
If, in the long-term [wikipedia.org], Wikipedia's image [wikipedia.org] is tarnished [wikipedia.org] by this, it is well-deserved.
See also:
* Wikipedia [wikipedia.org] (external link)
Re:Shame on Wiki (Score:2)
the two guys (Score:5, Funny)
Time to change my password... (Score:2)
Re:Time to change my password... (Score:2)
1 2 3 4 5 (Score:2, Funny)
Passwords... (Score:2, Funny)
http://en.wikipedia.org/wiki/Password_policy [wikipedia.org]
to try to avoid this:
http://en.wikipedia.org/wiki/Password_cracking [wikipedia.org]
40 years of UNIX (Score:5, Insightful)
Re:40 years of UNIX (Score:2)
Re:40 years of UNIX (Score:2)
In case anyone's wondering, you obviously need to store the salt somewhere but it's of no use unless you know the original password to add it to. In other words, reversing the hash with the sal
Re:40 years of UNIX (Score:2, Informative)
Salt (Score:2)
Re:Boneheaded Wiki Admins :( (Score:2)
Doesn't know diddly about hashing (Score:5, Informative)
Anyone who, in this day and age, writes a system whereby two users assign themselves the same password and end up with the same hashed password ought to be shot. Add a little SALT!
Re:Doesn't know diddly about hashing (Score:3, Interesting)
Re:Doesn't know diddly about hashing (Score:2)
And how does not being a clown prevent that? The number of exactly 7 letter combinations without case sensitivity is more than that can be uniquely enumerated in a 32 bit number. Consider all non-letters and case sensitivity, it is impossible to prevent zillions of uber-secure looking passwords' hash collide with the hash of "password"
Re:Doesn't know diddly about hashing (Score:2)
this is true, but so unlikely as to simply be disregarded.
Re:Doesn't know diddly about hashing (Score:2)
In Wikipedia we trust (Score:2)
Those who, like me, don't quite know what a salt is in hashing, can consult wikipedia [wikipedia.org].
The article is a stub, so it could use some improvement [wikipedia.org] I guess.
Saw this on K5 (Score:2)
Re:Saw this on K5 (Score:2, Funny)
Not me! You couldn't hack into my account that way! No siree! I always use different passwords for each site that I'm on. That way, even if the site is unscrupulous I have nothing to worry about on the other 500 sites I have accounts on.
Unfortunately, to remember them all I just use the name of the site as the password for my account.
Re:Saw this on K5 (Score:2)
Actualy i use the name of the site at the start then have a song to remember the rest of the password.
Re:Saw this on K5 (Score:2)
The only way you could be that is if you were a troll who had created multiple sockpuppet accounts.
Re:Saw this on K5 (Score:2)
Big deal. Everyone in each group is the same person. That was the point of the list...to find "sock-puppets," people who create multiple accounts for the purpose of harassing, getting around bans, etc.
You already presumably know your own password.
Re:Saw this on K5 (Score:2)
According to the theory of the person who compiled the list. And there's abolutely no chance -- nuh-uh, none -- that these passwords might be common because they're common words.
Re:Saw this on K5 (Score:2)
(RTFA to see whose passwords they gave out.)
Re:Saw this on K5 (Score:2)
3 most commonly used passwords (Score:2)
"Love, secret, and uh, sex. But not in that order, necessarily, right?"
"Yeah but don't forget God. System operators love to use God. It's that whole male ego thing."
Personally, I like to use "Tehl33th4x0rb0y", because it satisfieds the strong password requirement
Whew, I'm safe! (Score:2, Funny)
Good thing my password is *********.
I use my dog's name as my password. (Score:2, Funny)
My dog's name is currently "rV4q-p2", but I change it every 90 days.
Re:I use my dog's name as my password. (Score:2)
Obligatory bash.org (Score:4, Funny)
Cthon98> ********* see!
AzureDiamond> hunter2
AzureDiamond> doesnt look like stars to me
Cthon98> *******
Cthon98> thats what I see
AzureDiamond> oh, really?
Cthon98> Absolutely
AzureDiamond> you can go hunter2 my hunter2-ing hunter2
AzureDiamond> haha, does that look funny to you?
Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as *******
AzureDiamond> thats neat, I didnt know IRC did that
Cthon98> yep, no matter how many times you type hunter2, it will show to us as *******
AzureDiamond> awesome!
AzureDiamond> wait, how do you know my pw?
Cthon98> er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
AzureDiamond> oh, ok.
Old News (Score:2)
Apparently this is over a year old and is being spun by the article submitter.
No passwords leaked (Score:3, Informative)
All the accounts listed on this page have been created solely for the purpose of trolling, and this page was set up to make it easier to determine whether two troll accounts belong to the same person.
No passwords have been leaked, and the only people affected are trolls.
You're missing the point (Score:5, Informative)
2) A quick glance at those lists shows that they're all duplicate ("sock-puppet") accounts, and they're mostly from trolls. If you haven't watched Wikipedia much, you may not know the illustrious story of the sock-puppets, but even seemingly unrelated names (e.g., Lir and Pizza Puzzle) are widely believed to be the same user.
3) This story is what they call "FUD". If someone finds a valid user's account among these, then tell the user, and say that you found one (you don't have to say who). Until then, since the page appears to be all sock puppets, don't assume that there are innocent civilians caught in the collateral damage. As the page says, "all the accounts listed on this page have been created solely for the purpose of trolling." Only when that claim is disproven does the page become a worry.
-- User:Geoffrey on Wikipedia
Re:You're missing the point (Score:2)
Because, y'know, guilty until
Re:You're missing the point (Score:4, Insightful)
Yes, and as such everyone in the same heading now knows the password for everyone else in the same heading. Given the high likelihood that many of the accounts are trolls, that means if innocent Wikipedian "you" happen to share a password with a troll, that troll knows it now. Lucky you.
they're mostly from trolls.
What, only "mostly"? Not a very strong assertion in the face of a potential privacy violation. C'mon, if you're gonna assert that you intend to "out" only the trolls, you need to stick to the story. Admitting that the list is "mostly" trolls is admitting that the list is "partially" innocents. Who have now been screwed.
As the page says, "all the accounts listed on this page have been created solely for the purpose of trolling."
Well, then, obviously there's no story. Silly us. The creator of the page says there's no innocents listed, therefore there are no innocents listed.
In related news, Microsoft Windows is the most secure server OS EVAR!!! MS's Marketing department sed so!
Only when that claim is disproven does the page become a worry.
No, in a sane world, the page is a worry until the counterclaim is positively proven: that there are demonstrably no innocent user IDs on the page.
Until then, I'm gonna watch that page and its automated incarnation (if it occurs) very carefully. I have been a moderately active Wikipedian up until now, but if I'm gonna get carpet-bombed just because I accidentally move in next door to a troll, I'll find someplace else to contribute.
Re:You're missing the point (Score:2)
You say that like it is a bad thing. Did you know that to have someone put to death in the USA there can be doubt as to that persons innocence and they will still fry 'em until they are de
Re:You're missing the point (Score:2)
That's a bad attitude to take. You might not care whether your account is secure, but you should still expect it to be.
Re:You're missing the point (Score:3, Informative)
Until then, I'm gonna watch that page and its automated incarnation (if it occurs) very carefully.
I hope you watch carefully enough to discover that there is no automated incarnation, that the page is a year old, and that the developer involved agreed that there were security issues, apologized, and will not do it again.
After that your watch may get somewhat boring.
Strong! (Score:2)
This whole story is flamebait (Score:5, Interesting)
Why would we publish a list of account with identical passwords? Because certain trolls are known to register multiple accounts with the same password, and use them to troll, vote stuff, and all sorts of other unpleasant activities. Of course, many times, it is not hard to guess who those accounts belong to based on editing habits, but of course the trolls in question will deny it. But being matched by password was a one-time way to shoot through all their lies. This whole story is old, and the summery is horrible biased.
YHBT HAND (Score:5, Informative)
That was the only time I published such lists. They were constructed by searching the database for password matches with the few most active trolls on Wikipedia at the time. People complained about the possibility that innocent users with weak passwords might have been affected. I conceded the point, apologised, and promised not to do it again. The issue was played up at the time by the trolls who were exposed -- not surprisingly, I wasn't winning any friends in that camp. Those same trolls still whinge about the existence of the page today.
At the time, some people wanted the page deleted to protect any innocent people who might have been listed. The majority wanted the page kept as evidence against the trolls. I had no opinion either way, and so let the page remain in accordance with community wishes.
Nobody has ever identified a non-troll account on that page. No innocent person has complained to me that they were affected. None of the accounts (aside from the known troll accounts) had any identifying information associated with them.
Mod Up! (Score:2)
Jeez, people! (Score:2)
Repeat, the passwords were not leaked... But, if my Wikipedia password is l
Tempest in a teapot (Score:5, Informative)
Unfortunately, Tim at the time didn't run a password checker against the hashes, which could have thrown weak passwords out of the list and thereby prevented legitimate accounts from being included with reasonable effectiveness.
The submitter clearly has an axe to grind (and may well be identical to the comment poster). No similar lookup has taken place since July 2004, so this story is a tempest in a teapot.
I would agree with the criticism in one regard: The decision not to delete the page was mistaken. One problem was that the deletion request came from a troll, which made a lot of people vote to keep the page "by default." The other problem is that the technical arguments to delete the page came in too late to make a difference.
In any case, as noted, this was months ago, has not been repeated since then, and any non-troll among the listed accounts can simply change their password. We're not talking about credit card data here, anyway -- creating a Wikipedia account takes 20 seconds and doesn't even require a valid email address. All that it contains are a bunch of user preferences.
Re:Tempest in a teapot (Score:2)
avoiding this exploit (Score:2)
For each user, generate a string of bits that is at least your cipher block length (160 bits for SHA1, IIRC)... save that string (cleartext) to the user profile. Then when you hash the password, add the "salt" to the end.
password + salt will always hash to the same value. And no two users with the same password will have the same hash. Problem solved.
Two lessons here: (Score:3, Insightful)
2. You should NEVER use a password for a site that's the same as an important password
I tend to have three tiers of password:
1. "junk" passwords for non-critical sites (like
2. secure passwords for web-based email, etc, that I wouldn't want getting out
3. High-security passwords for banking, etc (these are different for each site, and I write them down and keep the list in my safe.)
An Outrage! (Score:2, Insightful)
Wow! (Score:2)
Imagine: there's some chance that someone could use this to reduce the reliability of data on Wikipedia! The horror, the horror...
TWW
Re:Still Waiting (Score:2)
That's alright. You can always start reading Wikipedia articles now to improve your knowledge. Then perhaps go back to school and get a degree.
In a few years you might be able to leave the resturant industry and join others who read Wikipedia at the table.
Re:Still Waiting (Score:3, Funny)
According to this page I found [wikipedia.org], which seems reliable, "Its articles have been cited by the mass media and academia."
Re:Cracko Ho! (Score:2)