Comments on: Monster.com breached http://www.securitybreaklive.com/monstercom-breached.html IT Security Investigations and Insights by Steve Dispensa Fri, 27 Feb 2009 22:10:22 -0600 http://wordpress.org/?v=2.8.4 hourly 1 By: Steve http://www.securitybreaklive.com/monstercom-breached.html/comment-page-1#comment-15 Steve Fri, 27 Feb 2009 03:08:27 +0000 http://www.securitybreaklive.com/?p=84#comment-15 Browser plug-ins are indeed another alternative, although, again, if you're owned (even user-mode owned), as long as the bad guy can inject code, he can steal all of your passwords from that plug-in. But, with 41% of people using the same password on every site, this is definitely better than nothing. Browser plug-ins are indeed another alternative, although, again, if you’re owned (even user-mode owned), as long as the bad guy can inject code, he can steal all of your passwords from that plug-in. But, with 41% of people using the same password on every site, this is definitely better than nothing.

]]> By: Steve http://www.securitybreaklive.com/monstercom-breached.html/comment-page-1#comment-14 Steve Fri, 27 Feb 2009 03:06:12 +0000 http://www.securitybreaklive.com/?p=84#comment-14 Interesting; I was told (and read) that they did. In any case, the larger point is that if the plaintext you're securing is from a small number of possibilities (i.e. 1 billion in this case), there's only so much crypto can do for you. For what it's worth, it's worth pointing out that my one-way hash argument probably applies only to the password, not SSN's. I re-read what I wrote and I was thinking more of passwords at the time - SSN's generally need to be able to be decrypted to be worth storing in the first place. Anyway, again, the same argument about domain size applies. Interesting; I was told (and read) that they did. In any case, the larger point is that if the plaintext you’re securing is from a small number of possibilities (i.e. 1 billion in this case), there’s only so much crypto can do for you.

For what it’s worth, it’s worth pointing out that my one-way hash argument probably applies only to the password, not SSN’s. I re-read what I wrote and I was thinking more of passwords at the time – SSN’s generally need to be able to be decrypted to be worth storing in the first place. Anyway, again, the same argument about domain size applies.

]]> By: slow http://www.securitybreaklive.com/monstercom-breached.html/comment-page-1#comment-13 slow Thu, 26 Feb 2009 18:43:57 +0000 http://www.securitybreaklive.com/?p=84#comment-13 Steve- Monster doesn't store SSN, the only thing they could have possibly f'ed up is the password hashing. Steve- Monster doesn’t store SSN, the only thing they could have possibly f’ed up is the password hashing.

]]> By: Van http://www.securitybreaklive.com/monstercom-breached.html/comment-page-1#comment-11 Van Thu, 26 Feb 2009 15:31:36 +0000 http://www.securitybreaklive.com/?p=84#comment-11 Good article. Regarding the insecurity of a single password for all online accounts ... this is a great point. OpenID is one option, but it requires that the site uses OpenID, many which do not. Another option is one of the free browser plugins available that can achieve the same result all all sites you use. The PasswordMaker plugin for Firefox is a good example of how to avoid this sort of issue. Good article. Regarding the insecurity of a single password for all online accounts … this is a great point. OpenID is one option, but it requires that the site uses OpenID, many which do not. Another option is one of the free browser plugins available that can achieve the same result all all sites you use. The PasswordMaker plugin for Firefox is a good example of how to avoid this sort of issue.

]]>