Reputation.com Loses User Passwords, Emails, and Addresses

https://www.stormpath.com/blog/reputationcom-loses-user-passwords-emails-and-addresses

by chunsaker • 13 years ago

63 37 13 years ago

stormpath.com

jorts• 13 years ago

Is there a reason why in all of these compromises that they never state the type of encryption used on passwords?

dangrossman• 13 years ago

Because somewhere between 97% and 100% of the recipients of the message would only be confused by that information.

whatshisface• 13 years ago

Confusion, when followed by positive words, can make people happier sometimes. (Wow, I sure am glad they are so smart!)

I don't really see a big drawback to inserting a few extra words, if those words might get reputable people to say that the bad thing that just happened wasn't really so bad.

floody-berry• 13 years ago

It seems more likely that they don't realize it's even important until they get hammered for details on what they used. Some PR person asks an engineer and he says "Yeah, it's fine, we hash/encrypt the passwords.." and only after they eventually disclose what they were using and have it explained to them do they realize they screwed up.

iancarroll• 13 years ago

It's gonna need some reputation defense now.

lstamour2• 13 years ago

I'm always nervous when people say they've lost "encrypted" passwords. We need a "plain english" version of https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet or at least issue a warning when you create a "password" VARCHAR in MySQL ;-)

tptacek• 13 years ago

I really hate that OWASP page (it's not as bad as it used to be --- that is, godawful --- and now it's just incoherent) and think we shouldn't be directing developers to it. If there's something "OWASP" (whatever that is) is truly bad at, it's cryptography.

ineedtosleep• 13 years ago

I usually rely on OWASP for general guidelines, but if that page isn't enough for you, what is? (not a rhetorical question)

What should one look into in order to fill in OWASP's gaps?

gcr2• 13 years ago

What things would you change?

gcr2• 13 years ago

What's wrong with it?

kijin• 13 years ago

> issue a warning when you create a "password" VARCHAR in MySQL

I put my salted and bcrypt'ed passwords in a CHAR or VARCHAR column named "password". Anything wrong with that? Should I change the name of the column to something like "hashed_password"?

aptwebapps• 13 years ago

The name of the column isn't a problem, rather it's an opportunity to nudge the developer a bit. Or that's how I read the GP's comment.

superflit• 13 years ago

So their reputation is lost?

joshguthrie• 13 years ago

When I first read the title, I thought they litteraly LOST their database contents.

useflyer• 13 years ago

Its absolutely flabbergasting when a company, which has the sole purpose of protecting customer information, allows this to occur. They've raised 4 major institutional rounds (their last $42 million), its discomforting that neither their team nor investors thought to secure their systems better than this.

sneak• 13 years ago

mumble mumble invisible hand mumble

skrebbel2• 13 years ago

I didn't get it.

Hitchhiker• 13 years ago

" That is a funny business because on a net basis, the whole investment management business together gives no value added to all buyers combined. That's the way it has to work. " - Charlie Munger ( http://ycombinator.com/munger.html )

furqanrydhan• 13 years ago

I worked there as one of their first engineer's, It's surprising to me that they've raised that much $, however the hack isn't. Incompetence is a word I use fairly when describing my time there...

electic• 13 years ago

This is really bad for their reputation.

brandon_wirtz3• 13 years ago

Reputation.com has always been smarmy. It wouldn't surprise me if they sold the passwords and then claimed they lost them. (Really)

For the things Reputation.com does you have to ask why they used encrypted rather than hashed passwords. Not that hashed passwords would make me super excited to be lost, but why did Reputation.com need to keep the password around? They don't really interact with accounts, and if they do those should be stored separately from the access to the site. So the message should have been "we lost users bank account passwords" or something along those lines.

Because I know that Reputation.com is practically in the extortion business this password storing rather than hashing issue makes me think even less of them, which is difficult to do.

tekacs2• 13 years ago

The passwords _were_ salted and hashed (the article and e-mail screenshot both mention this).

It's no s/b/...crypt but they don't seem to have been 'kept around'.

tekacs2• 13 years ago

Aaand having posted this, he reads the first comment on the page which states the opposite... in contradiction to the posted screenshot of the supposed e-mail.

o_O

just2n2• 13 years ago

As a friendly tip, this isn't your YouTube comments page for why Node.js is stupid, so we'd appreciate it if you would take the few minutes of your time and read the article before jumping to conclusions or stating facts without credible sources.

brandon_wirtz3• 13 years ago

Really? What does encrypted mean? Hashed is not encrypted. You can't unhash. You can find a known source of that hash, but you can't "decrypt".

Knowing this. Salted and Hash and Encrypted doesn't make any sense. So either they are BSing because they are stupid. Or because they are dishonest.

From where I stand it doesn't really matter which of the two they are. When it comes to privacy I have no tolerance for Stupid or Dishonest.

As for the statement that they aren't legally required to notify you... That's not true. If any of the people on the list live or access their account from North Carolina, or any of the 14 other states that use NC's breach terms then they would have to. Since it is nearly impossible to tell that this is not the case they legally have to give notice. A company that deals in Reputation Management should know this.

PS Friendly Tip regarding credible sources I can already buy the list online. With passwords in decyphered. This doesn't lend well to they were Hashed and Salted.

bredren• 13 years ago

This article sort of glosses over the exact user data lost in the data breach: names, email and physical addresses. For users some, phone numbers, date of birth and occupational info.

That is a lot of personal data to lose given Reputation.com's supposed to be opening a data privacy vault this year.[1] The founder gave interview to Fox March 1st describing Reputation.com's move into vendor relationship management.[2]

Advocates for personal data vaults / VRM business model[3][4] like Reputation.com and Personal.com stress that personal data is mishandled today, especially by data brokers. Thus it must be particularly frustrating for Reputation.com to be directly involved in a data breach.

[1] http://www.nytimes.com/2012/12/09/business/company-envisions...

[2] http://www.reputation.com/reputationwatch/multimedia/michael...

[3] https://cyber.law.harvard.edu/projectvrm/Main_Page

[4] http://www.nytimes.com/2012/02/13/technology/start-ups-aim-t...

DigitalSea• 13 years ago

Losing information on the scale these guys have is no doubt going to be bad for their reputation.

pentarim• 13 years ago

Bad reputation

xntrk• 13 years ago

Seems like a good letter to send for a fishing scam. Call this number that has nothing to do with our company and give them more personal info to "watch your credit".

Cherian_Abraham• 13 years ago

Ironic. More over, this is exactly why AirBnB should not become an identity store (asking their customers to become verified by scanning and sending their passport info). I do not trust them with my identity.

Reputation.com Loses User Passwords, Emails, and Addresses

Related Stories