Pinboard (guardiantech)

Important security update and password reset >> League of Legends

guardiantech — 2013-08-20T21:10:12+00:00

The security of your information is critically important to us, so we’re really sorry to share that a portion of our North American account information was recently compromised. What we know: usernames, email addresses, salted password hashes, and some first and last names were accessed. This means that the password files are unreadable, but players with easily guessable passwords are vulnerable to account theft.
Additionally, we are investigating that approximately 120,000 transaction records from 2011 that contained hashed and salted credit card numbers have been accessed.

Why you don’t want to use the default password for your iPhone personal hotspot >> 9to5Mac

guardiantech — 2013-06-20T04:47:19+00:00

Ben Lovejoy:

Researchers at the University of Erlangen in Germany found that Apple uses a dictionary of 52,500 words from an open-source Scrabble game to generate the passwords, with random numbers appended to them, but appears to be using only 1,842 words at present. Although that allows for a unique password for each iOS device, password strength is low.
Using a single computer, it took a maximum of 49 minutes to crack a password, but using an array of just four powerful processors would enable 100% success in just 50 seconds. They called on Apple to switch to true randomly-generated passwords to boost security.

You might get hacked, but at least you'll have a 272-point score.

Lousy ABC cryptography cracked in seconds as Aussie passwords are exposed >> Troy Hunt

guardiantech — 2013-02-27T10:43:22+00:00

45 seconds. That's how long it took to crack 53% of the [Australian Broadcasting Corporation's] now very public password database. That's more than half of the almost 50,000 passwords that were publicly exposed today. How the passwords (among other data) were exposed is yet to play out, but what we now know for sure is that the mechanism the ABC used to protect these credentials was woefully inadequate.

In case you're wondering, the Guardian's encryption system for user passwords is different from ABC's, and very substantially harder to crack.

Why passwords have never been weaker—and crackers have never been stronger >> Ars Technica

guardiantech — 2012-08-21T15:25:47+00:00

The average Web user maintains 25 separate accounts but uses just 6.5 passwords to protect them, according to a landmark study (PDF) from 2007. As the Gawker breach demonstrated, such password reuse, combined with the frequent use of e-mail addresses as user names, means that once hackers have plucked login credentials from one site, they often have the means to compromise dozens of other accounts, too.
Newer hardware and modern techniques have also helped to contribute to the rise in password cracking. Now used increasingly for computing, graphics processors allow password-cracking programs to work thousands of times faster than they did just a decade ago on similarly priced PCs that used traditional CPUs alone. A PC running a single AMD Radeon HD7970 GPU, for instance, can try on average an astounding 8.2 billion password combinations each second, depending on the algorithm used to scramble them. Only a decade ago, such speeds were possible only when using pricey supercomputers.

(Thanks @tehgreatgonzo for the link.)

Yahoo breach: Swiped passwords by the numbers >> CNET News

guardiantech — 2012-07-12T17:00:32+00:00

CNET's Declan McCullagh wrote a program to analyze the most frequently used passwords and e-mail domains that surfaced in the breach. The following tidbits are culled from his effort:
• 2,295: The number of times a sequential list of numbers was used, with "123456" by far being the most popular password. There were several other instances where the numbers were reversed, or a few letters were added in a token effort to mix things up.
• 160: The number of times "111111" is used as a password, which is only marginally better than a sequential list of numbers. The similarly creative "000000" is used 71 times.
But in a month's time they were going to change it to 000001, right?

Last.fm Password Security Update >> Last.fm

guardiantech — 2012-06-07T21:11:15+00:00

We are currently investigating the leak of some Last.fm user passwords. This follows recent password leaks on other sites, as well as information posted online. As a precautionary measure, we’re asking all our users to change their passwords immediately.

This is getting repetitive. Who's next?

YouPorn hacked user database >> Is It Hack Day

guardiantech — 2012-02-24T06:40:28+00:00

YouPorn got hacked and the user names and passwords leaked onto the web. The information is interesting, with passwords being very simple and most emails having been created for the purpose of consuming adult material.

The common passwords contain the usual suspects… well, slightly more sexual, actually, than usual.

Report: Analysis of the Stratfor Password List >> Tech Herald

guardiantech — 2012-01-05T06:09:14+00:00

"Just before the holiday weekend, as their final act of defiance in 2011, AntiSec supporters published nearly a million records taken during the Christmas Eve attack on Strategic Forecasting Inc. The Tech Herald has examined the list of 860,160 passwords hashes that were leaked, and the results of our tests were both expected and pitiful.
"We’re sorry to report that the state of password management and creation is still living in the Dark Ages."

This story never changes. Why are we surprised any more? Are we surprised any more? The more worrying aspect is "password recycling" where people use the same password in multiple places.

Passwords of 93,000 Politicians, Reporters, Bloggers Leaked >> Falkvinge on Infopolicy

guardiantech — 2011-10-26T17:02:40+00:00

Confusing tale, but huge implications.

Generate long, easy-to-remember passwords >> Passphra.se

guardiantech — 2011-08-30T21:56:21+00:00

Inspired by this XKCD strip.

A brief Sony password analysis >> Troy Hunt

guardiantech — 2011-06-07T05:29:04+00:00

"We end up with 93% of accounts being between 6 and 10 characters long which is pretty predictable. Bang on 50% of these are less than eight characters. It’s interesting that seven character long passwords are a bit of an outlier – odd number discrimination, perhaps?
"I ended up grouping the instances of 20 or more characters together – there are literally only a small handful of them. In fact there’s really only a handful from the teens onwards so what we’d consider is a relatively secure length really just doesn’t feature."

Interesting analysis; only 1% of passwords don't contain an alphanumeric character. But of course those 20-character passwords are all useless anyway, as they were stored in cleartext.