Disqus Confirms Over 17.5 Million Email Addresses Were Stolen In 2012 Hack of Its Comments Tool (zdnet.com) 81
Disqus, a company that builds and provides a web-based comment plugin for news websites, said Friday that hackers stole more than 17.5 million email addresses in a data breach in July 2012. "About a third of those accounts contained passwords, salted and hashed using the weak SHA-1 algorithm, which has largely been deprecated in recent years in favor of stronger password scramblers," reports ZDNet. From the report: Some of the exposed user information dates back to 2007. Many of the accounts don't have passwords because they signed up to the commenting tool using a third-party service, like Facebook or Google. The theft was only discovered this week after the database was sent to Troy Hunt, who runs data breach notification service Have I Been Pwned, who then informed Disqus of the breach. The company said in a blog post, posted less than a day after Hunt's private disclosure, that although there was no evidence of unauthorized logins, affected users will be emailed about the breach. Users whose passwords were exposed will have their passwords force-reset. The company warned users who have used their Disqus password on other sites to change the password on those accounts.
Meh. (Score:4, Informative)
I'm really not sure how much I consider an email "breach" all that big a deal. Most people use semi-disposable email anyway, and how is your email address much more secret than your street address? I suppose they could use them in a big data-mining cross-reference deal, but at this point, I'm kind of "so what".
Re:Meh. (Score:5, Informative)
It wouldn't be a big deal, except that people generally have terrible password habits. The main issue here will be people who tend to use the same password in multiple places.
The risk is if the hashes are cracked (which is doable if someone thinks it's worth the effort). If that's done, then there will be a sizable percentage of people who use the same email address combined with the same password on other sites too. Potentially banking sites, ebay accounts, etc. Thieves know people do this, and look for it.
Those people are at severe risk and need to know.
Re: (Score:2)
Typically when millions of passwords are leaked with just a basic hash and no salt, 99% of them are cracked within a month.
Publicly cracked by people looking to show up the poor security, that is. Presumably anyone with bad intentions spends a few bucks on Amazon EC2 instances so they can get to abusing them ASAP.
Re: (Score:2)
Most people use semi-disposable email anyway".
Wait what? Where do you get this idea?
Re: (Score:3)
Most people use semi-disposable email anyway".
Wait what? Where do you get this idea?
Maybe he got it from people who semi-doublequote quotes
Re: (Score:2)
Ahhh now that's some good /.
Re: (Score:2)
Most people use semi-disposable email anyway
No they don't.
and how is your email address much more secret than your street address?
Because it requires money and effort to spam me at my street address, but almost none at my email address.
Disgus? (Score:1)
Re: (Score:2)
No, it’s a play on ‘disgust’, as in the commenting system that keeps logging you out of your account on a site at random unexpected times. And when you find yourself logged out, generally after hitting ‘Reply’ and composing a beautiful rejoinder to some clueless moron who could benefit so by your crystalline reasoning, you find that the Disqus login pop up just flashes by, disappearing without letting you enter anything.
The bright side is that a site that uses Disgust is at lea
Re: (Score:2)
I had to look up Livefyre because I'm a social media retard, and I almost drowned in my gulp of mountain dew when I saw this on their website:
Engage people with the voices they trust. Their own.
http://www.adobe.com/ca/market... [adobe.com]
The url itself is already a cuntpuncher, it has "marketing-cloud" and "experience-manager" in it, as well as "platform". Well played, Adobe, almost got a bullshit bingo in the address bar alone.
Re: (Score:2)
Disgus (Score:1)
Freudian slip?
Disqusting. (Score:1)
I wonder how many more upcoming breach announcements we'll have, all hoping to get away with minimal casualties because they aren't as bad as the disasters at Equifax and Yahoo.
Re: (Score:2)
He is right though. If you can get yourself to trust HaveIBeenPwned.com (and it's a pretty well-known security site), then you get free reports of all major password leaks from all other sites, even itself if that ever happens. If you can't trust it, then you you implicitly trust *all* the other sites you sign up for to not get hacked, or to reliably notify you when they do. Now which is easier: to trust one site, or to trust all of them minus the first one?
Re: (Score:2)
Yep. I use the notifications from that site to remind me when it's time to change all my important passwords.
Re: (Score:2)
NFI what you're asking.
Re: Have I Been Pwned Website (Score:2)
Every single email that I checked shows to have been compromised. Sigh.....
Re: (Score:2)
no but in the summary they already mention the website and the fact that it's the guy who runs haveibeenpwned that told disqus about the breach. Then creimer steps in and mention the site in his insightful comment.
That's like telling a joke to two retards then hearing one of them telling the joke to the other.
this is my email address. there are many like it, (Score:1)
SHA-1's flaws have nothing to do with this (Score:5, Informative)
"About a third of those accounts contained passwords, salted and hashed using the weak SHA-1 algorithm, which has largely been deprecated in recent years in favor of stronger password scramblers,"
Sigh. If you're going to pick a quote, pick one that states a meaningful fact. SHA-1's flaw is that it allows a pre-image attack, where an attacker can craft a duplicate message that yields the same hash value as a different message, which is very useful for forging signatures on certificates. But that flaw is utterly useless for more efficiently brute force attacking a password that was hashed with SHA-1.
All the information I gleaned from this quote is that the author doesn't understand what he's talking about, and his writing isn't worth reading. Oh, and that my password on Disqus is still safe.
Re: (Score:2)
Yes, you're right. I totally missed that!
Passwords are special. SHA-1 is much too fast (Score:4, Interesting)
You are absolutely correct for SHA-1 hashes of random data, of significant length. Passwords, however, are neither random nor long. I'll describe the attack for you and you can try it out yourself. The fact that an ordinary consumer PC can compute SHA-1 password hashes at the rate 10 billion per second is why SHA-1 is no longer appropriate for passwords. Here's how the attack is done:
Download two large lists of passwords, any "combined list" from your favorite haxor site will do. It doesn't matter what sites the passwords are from. If you run a comparison, you'll find that given two lists of a million passwords, about half of the passwords will be on both lists - with different accounts. That is, there is about a 50/50 chance that your password is in the list because somebody else used the same password. You probably know it's not too hard to find lists totaling many millions of passwords (we don't need fresh ones). If we put together a list of 10 million passwords, most of the Disqus passwords will be on our list, because SOMEBODY used the same password (not necessarily the same person).
So we take the first, most common password on our list of previously seen passwords and try it against each of the 17 million hashes from Disqus. Because SHA-1 is so fast, our $100 GPU can check all 17 million hashes in one millisecond. In one second, we can try the top thousand most common passwords. In 24 hours, we can test out 10 MILLION passwords that somebody, somewhere, has used before, and thereby crack perhaps 8 million of the Disqus passwords - which gives us the email addresses to match those passwords.
For passwords, therefore, you need a hash that can't be easily computed at the rate of billions per second with commodity hardware. Bcrypt and scrypt are appropriate choices. To avoid certain problems with particularly long or particularly short passwords, you first take a SHA-2 hash of the password, then scrypt it.*
* In the general case of random data, hashing a hash doesn't add security. Passwords, however are not the general case.
Re: (Score:2)
first take a SHA-2 hash of the password, then scrypt it.*
* In the general case of random data, hashing a hash doesn't add security. Passwords, however are not the general case.
Did you really have to end your main comment with a footnote reference, immediately followed by the footnote? That blatant abuse of footnotes creates a dark cloud of suspicion over your message, which is too bad because I was with you up to that point.
Re: (Score:2)
And that in no way defends the incorrect assertion of the article's author that associates SHA-1's flaws with this attack, which was the entire point I was trying to make.
Regarding the security of the password hash database that was stolen, I was assuming a few things: that the attackers are lazy, and while they might try a rainbow table, they won't bother brute-force hashing salted passwords; and that when disqus says they used a salted hash, that they actually used a proper per-user salt algorithm, and no
websites need to allow logins other than goog/twtr (Score:2)
I really don't trust these sites to do a good job... but only allowing google and twitter oauth providers is pathetic
Re: (Score:2)
Years ago, I used Yahoo!'s OAuth provider to sign up on lots of sites. That sure kept my accounts secure! :-/
Re: (Score:3)
The problem with oauth and the like is that they are a bit like keeping all your eggs in one basket. If the auth provider is breached, it is theoretically possible for credentials to be forged. Unlikely, but possible. It's generally better to compartmentalize, so a breach at one place won't make you vulnerable anywhere else.
On the other hand, people really don't like doing passwords in a secure way. It is, admittedly, a real hassle. If you aren't going to do passwords securely, then you're much better off u
Re: (Score:2)
It's also annoying if you close your Google account and those sites are tied to it.
Re: Yet another massive government failure. (Score:1)
That is so true. They came within a few million votes of having #CrookedHillary elected. If that isn't a failure, what is?
Re: (Score:1)
Back during the election this line made me laugh.
"Both Hillary and Trump will cause an apocalypse, however Hillary's apocalypse will be cold and gray, like The Road. By contrast Trump's apocalypse will be loud and garish with flamethrowing electric guitars, like Mad Max : Fury Road"
Hmmm... (Score:2)
Scam (Score:1)
Disqus is a scam.
A while ago we had a news discussion where we found the following rules for cencorship:
"Putin is an Idiot" is censored.
"Trump is an Idiot" is censored.
"Obama is an Idiot" is NOT censored.
"Merkel is an Idiot" is NOT censored.
So now we got curious, we edited the already posted texts by exchanging the names randomly... at first the "new" anti-Putin comments where up for a couple of minutes puplicly and then got cencored. The "new" Anti-Obama-comments on the other hand where still block
Breach in 2012 (Score:2)
Re: (Score:2)
...and now 5 years later they notice it? Why are companies like that still allowed to stay in business?
My guess is that the evidence of the attack from 5 years ago has long since been destroyed. Disqus *never* noticed it themselves, they were only recently informed of it by Troy Hunt, who obtained a copy of the stolen database and then contacted them.
Anyway, there isn't a law against being incompetent. There may still be consequences, however, if their clients get mad at them for this breach and abandon disqus in favor of another commenting system.
So, if we add that 17.4 million . . . (Score:2)
Good! (Score:1)