News for hackers. Stuff that matters.

A comment on RIP LivingSocial: The fast rise and slow demise of a daily deals company.

Re:RIP LivingSocial: The fast rise and slow demise of a dail... by swang on Sunday February 26, 2017 @04:45AM (#13736480)
> As executives reflect on LivingSocial’s fatal moment, all point to a security breach in April 2013. Hackers gained access to the account information of 50 million subscribers, and LivingSocial forced all of them to reset their passwords. About 20 percent never came back.

I don't know how they came to this number, but at least it's something to point to when the c-level executives decide password security is something that they can just skip doing. Obviously part of that 20% is are just dead accounts but still, something to show next time you're in this situation.

[ Parent | on HN ]
Re:RIP LivingSocial: The fast rise and slow demise of a dail... by HalfwayToDice on Sunday February 26, 2017 @05:05AM (#13736529)
80% of total members continued to use the website after the password reset? That seems too high. Perhaps they meant 80% of active members. Unless the website had an incredibly low churn rate.
[ Parent | on HN ]
Re:RIP LivingSocial: The fast rise and slow demise of a dail... by protocow on Sunday February 26, 2017 @09:12AM (#13737285)
Or c-level executives will remember this tidbit before they let their security folks talk them into a password reset after a breach. You have to wonder whether a company in that situation has other options, like blocking logins from previously unseen IPs (for users who don't change passwords).
[ Parent | on HN ]
Re:RIP LivingSocial: The fast rise and slow demise of a dail... by hackerboos on Sunday February 26, 2017 @11:27AM (#13738002)
You think a company that was using SHA1 [0] to hash passwords was actually logging IP addresses?

[0] - https://arstechnica.com/security/2013/04/why-livingsocials-5...

[ Parent | on HN ]
Re:RIP LivingSocial: The fast rise and slow demise of a dail... by draw_down on Sunday February 26, 2017 @10:39AM (#13737687)
Hmm, isn't that the opposite of a good example? Here's what I feel like a C-level exec would take away from that story: if you ask users to reset their password, you'll lose 20% of them.
[ Parent | on HN ]
Re:RIP LivingSocial: The fast rise and slow demise of a dail... by swang on Sunday February 26, 2017 @04:42PM (#13740084)
my viewpoint was once there is a breach there will be anger and maybe 20% of our customers don't come back. not resetting passwords and possibly further endangering your customer base seems like a bad idea.

but i can see someone taking your viewpoint... which is worrying.

[ Parent | on HN ]