Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 Internet speed test! ×
Japan Security

eBay Japan Passwords Revealed As Username+123456 80

mask.of.sanity (1228908) writes "eBay Japan created passwords for accounts based on a combination of a username plus a static salt, allowing anyone with knowledge of it to access any account, a researcher reported. The salt, which should have been random, used was the combination '123456', which was reported as last year's worst password." Complete with visual aids.
This discussion has been archived. No new comments can be posted.

eBay Japan Passwords Revealed As Username+123456

Comments Filter:
  • by raymorris ( 2726007 ) on Thursday March 27, 2014 @04:04PM (#46595689) Journal

    My interpretation is that they used a) as b), which should be fine if the salt was actually salty. I think they did:

      default_password = crypt(username+salt)

    That would be fine if they used real salt (random), but instead they used Mrs. Dash salt substitute.

  • Not salt (Score:5, Informative)

    by blueg3 ( 192743 ) on Thursday March 27, 2014 @04:20PM (#46595857)

    It looks from the video that the password is simply the username concatenated with a global string, "123456".

    That's not salt. That's not what the word means. A salt is data that is not part of the password but is combined with the password when hashed. The client side never sees salt.

    So all these discussions of salt are not at all relevant.

    This is fundamentally a case of hard-coded credentials [], which is more stupid than a non-random salt. (Also, really, transmitting credentials over HTTP?)

CCI Power 6/40: one board, a megabyte of cache, and an attitude...