News for hackers. Stuff that matters.
Re:Gawker Website source, databases & passwords now on BitTo... by kmfrk on Sunday December 12, 2010 @08:18PM (#1998775)
Having seen the pastebin link, these guys use really, really poor password. Only alphanumeric - usually just one of the two - rarely with capitalization, and nothing else.
Re:Gawker Website source, databases & passwords now on BitTo... by alanh on Sunday December 12, 2010 @09:58PM (#1999073)
The parent comment is likely referring to admin & username passwords for people working at Gawker Media, such as Gizmodo, Lifehacker, and Kotaku contributors.

All the usernames and passwords for users with {@lifehacker.com, @gawker.com, etc.} email addresses in the torrent (plaintext, not hashed). The torrent claims Nick Denton’s password was an 8-character sequence of even numbers, and that he used it everywhere. (Edit in reply: The hackers used this on e.g. his Twitter account IIRC so it wasn’t truncated to 8 characters.) Some of them are even '11223344' or a substring of the author’s username!

Re:Gawker Website source, databases & passwords now on BitTo... by wahnfrieden on Sunday December 12, 2010 @10:13PM (#1999108)
This isn't entirely accurate. Their hashing mechanism only hashes and stores the first 8 characters of the password. So you only need to get the first 8 right, even if the password is 12 long.

That also means that, although unlikely for some, '11223344' could have actually been '11223344aBc$!q'. Not that it would have mattered though!

Re:Gawker Website source, databases & passwords now on BitTo... by 27182818284 on Sunday December 12, 2010 @10:58PM (#1999243)
It matters a little outside of Gawker, right? Because a site that requires all of say, 12 characters, if the remaining 4 weren't predictable, would be safe even with the first 8 exposed.
Re:Gawker Website source, databases & passwords now on BitTo... by alanh on Sunday December 12, 2010 @11:18PM (#1999299)
Yeah, but only as “safe” as a 4-letter password. Assuming full alphanumerics, that’s only 14 million possible 12-character passwords to try. Given a 1GHz processor, well, you see where I’m going with this.

This is why I freaked out when bluehost.com (AVOID!) required the last four characters of my password to accompany support requests(!).

Re:Gawker Website source, databases & passwords now on BitTo... by 27182818284 on Sunday December 12, 2010 @11:38PM (#1999344)
Yeah I was just using the 12 as an example, but someone with say 36 chars past the 8 recovered from gawker should be a little more at ease.

I don't think I've logged into any of their sites, I use different passwords at different sites and they are generally > 20 chars, so I'm not worried. Yet, at the same time, even knowing all of that, I did a bit of a double take and had a brief "Oh shi-" moment of paranoia when I read the headline.

In fact, if I were say a young starlet that used a similar password for my private email or something as my Gawker account, I'd be really freaked!

Re:Gawker Website source, databases & passwords now on BitTo... by lukeschlather on Monday December 13, 2010 @01:01AM (#1999534)
Realistically, this isn't likely to compromise a strong 12 character password without a second breach at a different site. (In order for your 1GHz processor to have any bearing on the discussion, they need not only Gawker's password hashes, but another site you coincidentally have an account at that uses the same password.)
Re:Gawker Website source, databases & passwords now on BitTo... by pyre on Sunday December 12, 2010 @09:27PM (#1998979)
I was under the impression that the ones that were displayed w/ password were just the ones where the password was reversed from the hash. Does that apply to all accounts, or just to ones with weak passwords (i.e. there may be selection bias in that list).
Re:Gawker Website source, databases & passwords now on BitTo... by redthrowaway on Sunday December 12, 2010 @11:09PM (#1999276)
The group responsible put up a pastebin here: http://pastebin.com/9rRmf6W5 (Warning: questionable legality)

It lists a bunch of the password/email combinations (plaintext), and tells a bit about how they did it. I'm guessing they used a dictionary attack for the easy ones. Also displays chat logs from campfire that show the staff in a highly unfavourable light. Then again, their work does that just fine without any outside help.