I got my email from Gawker today
... the user name and password associated with your comment account were released on the internet...
Gawker was hacked - big time. Forbes has the gory details ...
The Real Lessons Of Gawker’s Security Mess - The Firewall - the world of security - Forbes
... Despite this, they do not really seem to be acknowledging the scale of what happened. They still try to put some blame back on users, suggesting that if they had a weak password they might be compromised. Well, that really does not make much of a difference when you expose the entire database table and have way too much faith in the 34 year old encryption algorithm reported to be used to safeguard the data...
Briefly, I take security far more seriously than Team Gawker. They were a big fat soft target.
I don't remember creating a Gawker account - I probably created it on io9 originally. I'm sure I used my throwaway password (still far more robust than most). I have retired that password, but it will now be a part of a future dictionary attack. I need to check that Emily doesn't use it any more either.
In the wake of these events there are typically calls to "use strong passwords". Except, of course, if the server side password store encryption is hacked then even the world's best password is useless. And, of course, there are keystroke loggers out there.
This is what I do now, but, really, we need two factor authentication urgently.
I did go through Gawker's password reset procedure, which seems to have given me a new username and password. There's no way currently to get to their accounts page so I'll just leave it as it is.
Update 12/14/10: This Lifehacker (Gawker) article on lessons learned from a hacked google account is quite ironic now. They didn't learn any lessons.
There've been two good commentaries today ...
- Coding Horror: The Dirty Truth About Web Passwords - not bad, but not as good as me. He's forgotten about keystroke loggers.
- Gawker hack analysis reveals incredibly weak passwords | Topics | Macworld: If the accounts were disposable, which they often are, there's no great problem with using a weak password. You don't put costume jewelry in a safe.
2 comments:
Frankly, anyone who reuses the same password on multiple sites is asking for trouble. Unless you have absolute trust in every site's backend security, use a completely unique password for everything.
Even Schneier doesn't use a different password on every account. I have hundreds of passwords in my database.
I honestly don't know anyone who does that on any scale, though you might be the exception
Post a Comment