MusicBrainz Password Leak

by jameswyse • 13 years ago

23 16 13 years ago

jameswyse3• 13 years ago

OP links to a copy of the email I received this morning.

Yet another company with a far too relaxed approach to security. What bothers me though is that they discovered this 2 weeks ago and I'm only hearing about it now.

The blog post they link to is dated April 5th: http://blog.musicbrainz.org/?p=1844

codygman• 13 years ago

LOL... mandatory=1 in the url? What happens if you set it to 0?

jameswyse3• 13 years ago

haha who knows..

Their site in general is pretty dumb. I logged in and deleted my account but it didn't log me out, it just changed my name to 'Deleted Editor #XXXXXX' - I can still edit all the account details.

batiudrami• 13 years ago

It's just a flag which adds some explanatory text on the page, rather than displaying the regular 'customer requests change of password' page.

gcp• 13 years ago

>Yet another company with a far too relaxed approach to security

What Data Was Leaked? bcrypt password hashes, with a cost parameter of 8, for all accounts as of March 25th 2013.

Wait, this is fine, isn't it? They did the right thing.

Cyphase2• 13 years ago

I wouldn't say 'fine'. They say the hashes were salted (which is good), but it's not clear whether all the salt was also leaked.

ocharles3• 13 years ago

Hi, I'm the guy who's pretty much responsible for all of this, but I just wanted to clarify a few things.

> Yet another company with a far too relaxed approach to security

I don't think we have a relaxed approach to security, we do our best to take it as seriously as possible. Sadly, we have only 3 programmers, a large legacy code base and generally insufficient resources. As we provide public data dumps anyway, it's unfortunate that mistakes can become as magnified as this one, but it did happen. It's not a reason this should of happened, and nor is it meant to be an excuse, but I don't think many people are aware of this.

> What bothers me though is that they discovered this 2 weeks ago and I'm only hearing about it now.

Yes, I've worked night and day to try and get the work necessary to even sand these emails out for the past fortnight. We've never had to do mass mailing like this, so we simply don't have the infrastructure to send the emails. Again, it's not really a reasonable explanation, but that's why it happened.

jameswyse3• 13 years ago

Hi there, thanks for taking the time to reply. I appreciate the effort involved and apologise for my harsh words - I've just been a little frustrated as it's getting to be a weekly occurrence that some company loses my data / password / credit card details.

Cyphase2• 13 years ago

Mine has a date! http://pastebin.com/dzRqSgGj

bredren• 13 years ago

I used to use MusicBrainz to sort out mp3 tags, it was pretty awesome back in the day. I don't really have that problem anymore.

MasterScrat• 13 years ago

Is there a service where I could indicate which websites I'm using, and that would warn immediately me if one of them is compromised?

I'd rather have a single, reliable source of information for this. Also I'd like to see the history of each service before I sign up.

MusicBrainz Password Leak

Related Stories