[ale] evernote security breach
Michael H. Warfield
mhw at WittsEnd.com
Mon Mar 4 15:07:38 EST 2013
On Mon, 2013-03-04 at 18:45 +0000, Lightner, Jeff wrote:
> One of my favorite complaints from password verification systems is
> “Your password is based on a dictionary word.” I’d always say “Show
> me what dictionary has ANY part of that!” So far as I could
> determine their definition of dictionary word was “It has letters and
> numerals in it”.
Actually, the better ones are based on things like cracklib that
actually run a password pass the rule sets used by things like John the
Ripper. That's going to include certain kinds of things like
substituting an @ for an A (or a). It's really frightening to see just
what these rule sets will zing you on. Sometimes, I swear, you think
the bloody thing is telepathic in its ability to match passwords and
hashes.
Alot of times the complexity checkers will report "was based on a
dictionary word" when what they really mean is that you failed, for one
reason or another, the cracklib test and your password was guessable by
one of the many dozens of ripper rule sets. Which ruleset and why is
anybody's guess but it's got to report back something. "No, it's not a
good password. John the Ripper would rip you. No we don't know why
it's bad." is not a good, user friendly, error message to report back
but it's the absolute truth.
Years ago, I saw cracklib zing one on a password we had assigned to
someone generated by a random password generator. Sure enough, it
reported that it was based on a dictionary word (without telling us
which one). We all started scratching our heads over it and went "no
bloody way" but the fact remained that it triggered on one of the
cracklib guessing rules. Game over. Doesn't matter if you can figure
out WHAT rule it triggered or WHAT word it thinks it's similar too. The
bottom line is that it triggered one of the well known guessing rule
sets and is, therefore, guessable.
The answer is not "Show me what dictionary has ANY part of that!" The
answer is "John the Ripper would have busted you because it matched one
of its rule. Thank you for playing, try again."
> By the way – if you install the “expect” package it comes with a
> command called “mkpasswd” that will generate random passwords for you.
Which can also be no guarantee.
Regards,
Mike
> From: ale-bounces at ale.org [mailto:ale-bounces at ale.org] On Behalf Of Richard Bronosky
> Sent: Monday, March 04, 2013 1:33 PM
> To: Michael H. Warfield; Atlanta Linux Enthusiasts
> Subject: Re: [ale] evernote security breach
>
> I use XKCD passwords http://xkcd.com/936/
>
> I've been pleasantly surprised to find most of the services I care about don't complain about my 30+ character passwords. I really wish they would be smarter about entropy measurement rather than just insisting on some stupid rules be satisfied.
>
> On Mon, Mar 4, 2013 at 12:58 PM, Michael H. Warfield <mhw at wittsend.com<mailto:mhw at wittsend.com>> wrote:
> On Mon, 2013-03-04 at 12:38 -0500, Ron Frazier (ALE) wrote:
> >
> > "Michael H. Warfield" <mhw at WittsEnd.com<mailto:mhw at WittsEnd.com>> wrote:
> >
> > >On Mon, 2013-03-04 at 09:35 -0500, Ron Frazier (ALE) wrote:
> > >> Hi all,
> > >
> > >> I first saw the link to this article on the dc404 mailing list. If
> > >you're an evernote user, you need to know about this.
> > >
> > >> http://www.theverge.com/2013/3/2/4056704/evernote-password-reset
> > >
> > >If you are an Evernote user, you need to change your password. The
> > >attackers had access to user-id's and password hashes. The passwords
> > >where hashed and salted but simple passwords are still subject to
> > >off-line brute force and rainbow table attacks. Change your password
> > >to
> > >a good, high complexity, password or passphrase.
> > >
>
> > Do you think a 15 character random alphanumeric generated by Lastpass is good enough? Or, should you go longer if the site will let you?
> That's probably reasonable although my personal preference is for pass
> phrases. I take several words (jaberwocky style) and mix in some
> numbers and punctuation. Much easier to remember and type (especially
> on a smart phone) and very much easier to remember.
>
> I run into more dain-bramaged sites that don't allow punctuation than
> really limit the length but there are some still out there that haven't
> gotten the memo and restrict your length to negligently short lengths.
>
> > >MOST IMPORTANT! This is NOT mentioned in the article quoted, but...
> > >If
> > >you used the same user id (E-Mail address) or similar and the same
> > >password on other sites, change all of them and use different passwords
> > >on each. It is not uncommon for someone to use the same password and
> > >id
> > >on different sites. It is equally not uncommon for attackers to KNOW
> > >THIS and, once they break your password on one site, to use a common,
> > >broken, password to attack other sites. That includes sites with other
> > >common variations on your user id.
> > >
> >
> > I've known this for some time, but only recently went to the trouble to do it, after Linkedin had their break in. I'm now using Lastpass, which is a good way to keep track of many different passwords for different sites. (I know there are other solutions too.) It was a major pain to go to every site I had and go through the password change procedure, especially because, for the ones that were already different, I had to look them up. However, every one is now different and random. Every time I generate a new password for a new site, or change one on an old site, I let Lastpass handle it. The password vault is secured by a master password that you don't give out online. If anyone is interested, I can post my recommended settings for Lastpass preferences. You can use the service for free on PC's, but have to pay a modest fee for Premium service to use on mobile devices. I pay the fee, and am glad to support their continued development.
> >
> > >> Sincerely,
> > >
> > >> Ron
> > >
> > >Regards,
> > >Mike
> > >
> > >
> > >--
> > >Michael H. Warfield (AI4NB) | (770) 985-6132<tel:%28770%29%20985-6132> | mhw at WittsEnd.com<mailto:mhw at WittsEnd.com>
> > >/\/\|=mhw=|\/\/ | (678) 463-0932<tel:%28678%29%20463-0932> |
> > >http://www.wittsend.com/mhw/
> > >NIC whois: MHW9 | An optimist believes we live in the best of
> > >all
> > >PGP Key: 0x674627FF | possible worlds. A pessimist is sure of
> > >it!
> > >
> > >
> > >
> >
> > --
> >
> > Sent from my Android Acer A500 tablet with bluetooth keyboard and K-9 Mail.
> > Please excuse my potential brevity if I'm typing on the touch screen.
> >
> > (PS - If you email me and don't get a quick response, you might want to
> > call on the phone. I get about 300 emails per day from alternate energy
> > mailing lists and such. I don't always see new email messages very quickly.)
> >
> > Ron Frazier
> > 770-205-9422<tel:770-205-9422> (O) Leave a message.
> > linuxdude AT techstarship.com<http://techstarship.com>
> >
> >
>
> --
> Michael H. Warfield (AI4NB) | (770) 985-6132<tel:%28770%29%20985-6132> | mhw at WittsEnd.com<mailto:mhw at WittsEnd.com>
> /\/\|=mhw=|\/\/ | (678) 463-0932<tel:%28678%29%20463-0932> | http://www.wittsend.com/mhw/
> NIC whois: MHW9 | An optimist believes we live in the best of all
> PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!
>
>
>
>
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org<mailto:Ale at ale.org>
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>
>
>
> --
> .!# RichardBronosky #!.
>
>
>
>
>
> Athena®, Created for the Cause™
>
> Making a Difference in the Fight Against Breast Cancer
>
>
>
>
>
> How and Why I Should Support Bottled Water!
> Do not relinquish your right to choose bottled water as a healthy alternative to beverages that contain sugar, calories, etc. Your support of bottled water will make a difference! Your signatures count! Go to http://www.bottledwatermatters.org/luv-bottledwater-iframe/dswaters and sign a petition to support your right to always choose bottled water. Help fight federal and state issues, such as bottle deposits (or taxes) and organizations that want to ban the sale of bottled water. Support community curbside recycling programs. Support bottled water as a healthy way to maintain proper hydration. Our goal is 50,000 signatures. Share this petition with your friends and family today!
>
>
>
> ---------------------------------
> CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.
> ----------------------------------
>
>
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
--
Michael H. Warfield (AI4NB) | (770) 985-6132 | mhw at WittsEnd.com
/\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 482 bytes
Desc: This is a digitally signed message part
URL: <http://mail.ale.org/pipermail/ale/attachments/20130304/92047fda/attachment.sig>
More information about the Ale
mailing list