6 ms·

Reputation.com Loses User Passwords, Emails, and Addresses

63 points by chunsaker 13y ago

jorts 13y ago
Is there a reason why in all of these compromises that they never state the type of encryption used on passwords?
- dangrossman 13y ago
  Because somewhere between 97% and 100% of the recipients of the message would only be confused by that information.
  - whatshisface 13y ago
    Confusion, when followed by positive words, can make people happier sometimes. (Wow, I sure am glad they are so smart!) I don't really see a big drawback to inserting a few extra words, if those words might get reputable people to say that the bad thing that just happened wasn't really so bad.
  - floody-berry 13y ago
    It seems more likely that they don't realize it's even important until they get hammered for details on what they used. Some PR person asks an engineer and he says "Yeah, it's fine, we hash/encrypt the passwords.." and only after they eventually disclose what they were using and have it explained to them do they realize they screwed up.
lucian303 13y ago
"That said, pointing out to users that you don't have to tell them when you've been breached might not make you any friends." Well, one state is enough. The news would have gotten out anyway from the North Dakota customers. Otherwise, there is no doubt they would have kept it under wraps.
iancarroll 13y ago
It's gonna need some reputation defense now.
lstamour 13y ago
I'm always nervous when people say they've lost "encrypted" passwords. We need a "plain english" version of https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet or at least issue a warning when you create a "password" VARCHAR in MySQL ;-)
- tptacek 13y ago
  I really hate that OWASP page (it's not as bad as it used to be --- that is, godawful --- and now it's just incoherent) and think we shouldn't be directing developers to it. If there's something "OWASP" (whatever that is) is truly bad at, it's cryptography.
  - ineedtosleep 13y ago
    I usually rely on OWASP for general guidelines, but if that page isn't enough for you, what is? (not a rhetorical question) What should one look into in order to fill in OWASP's gaps?
  - gcr 13y ago
    What things would you change?
  - gcr 13y ago
    What's wrong with it?
- kijin 13y ago
  > issue a warning when you create a "password" VARCHAR in MySQL I put my salted and bcrypt'ed passwords in a CHAR or VARCHAR column named "password". Anything wrong with that? Should I change the name of the column to something like "hashed_password"?
  - aptwebapps 13y ago
    The name of the column isn't a problem, rather it's an opportunity to nudge the developer a bit. Or that's how I read the GP's comment.
superflit 13y ago
So their reputation is lost?
- joshguthrie 13y ago
  When I first read the title, I thought they litteraly LOST their database contents.
useflyer 13y ago
Its absolutely flabbergasting when a company, which has the sole purpose of protecting customer information, allows this to occur. They've raised 4 major institutional rounds (their last $42 million), its discomforting that neither their team nor investors thought to secure their systems better than this.
- sneak 13y ago
  mumble mumble invisible hand mumble
  - skrebbel 13y ago
    I didn't get it.
    - Bill_Dimm 13y ago
      I think his point is that in an efficient market (invisible hand - an Adam Smith reference) incompetent companies should loose all of their customers to better companies and die.
      - skrebbel 13y ago
        Thanks! I didn't know it was an Adam Smith reference. It makes sense now.
- Hitchhiker 13y ago
  " That is a funny business because on a net basis, the whole investment management business together gives no value added to all buyers combined. That's the way it has to work. " - Charlie Munger ( http://ycombinator.com/munger.html http://ycombinator.com/munger.html )
- furqanrydhan 13y ago
  I worked there as one of their first engineer's, It's surprising to me that they've raised that much $, however the hack isn't. Incompetence is a word I use fairly when describing my time there...
electic 13y ago
This is really bad for their reputation.
brandon_wirtz 13y ago
Reputation.com has always been smarmy. It wouldn't surprise me if they sold the passwords and then claimed they lost them. (Really) For the things Reputation.com does you have to ask why they used encrypted rather than hashed passwords. Not that hashed passwords would make me super excited to be lost, but why did Reputation.com need to keep the password around? They don't really interact with accounts, and if they do those should be stored separately from the access to the site. So the message should have been "we lost users bank account passwords" or something along those lines. Because I know that Reputation.com is practically in the extortion business this password storing rather than hashing issue makes me think even less of them, which is difficult to do.
- tekacs 13y ago
  The passwords _were_ salted and hashed (the article and e-mail screenshot both mention this). It's no s/b/...crypt but they don't seem to have been 'kept around'.
  - tekacs 13y ago
    Aaand having posted this, he reads the first comment on the page which states the opposite... in contradiction to the posted screenshot of the supposed e-mail. o_O
    - chunsaker 13y ago
      I received and posted the email, and many others on twitter have also received it. Also, not sure we should take blog comments for the gospel before all the facts are out.
- just2n 13y ago
  As a friendly tip, this isn't your YouTube comments page for why Node.js is stupid, so we'd appreciate it if you would take the few minutes of your time and read the article before jumping to conclusions or stating facts without credible sources.
  - 13y ago
bredren 13y ago
This article sort of glosses over the exact user data lost in the data breach: names, email and physical addresses. For users some, phone numbers, date of birth and occupational info. That is a lot of personal data to lose given Reputation.com's supposed to be opening a data privacy vault this year.[1] The founder gave interview to Fox March 1st describing Reputation.com's move into vendor relationship management.[2] Advocates for personal data vaults / VRM business model[3][4] like Reputation.com and Personal.com stress that personal data is mishandled today, especially by data brokers. Thus it must be particularly frustrating for Reputation.com to be directly involved in a data breach. [1] http://www.nytimes.com/2012/12/09/business/company-envisions-vaults-for-personal-data.html?pagewanted=all http://www.nytimes.com/2012/12/09/business/company-envisions... [2] http://www.reputation.com/reputationwatch/multimedia/michael-fertik-fox-markets-now-data-vault http://www.reputation.com/reputationwatch/multimedia/michael... [3] https://cyber.law.harvard.edu/projectvrm/Main_Page https://cyber.law.harvard.edu/projectvrm/Main_Page [4] http://www.nytimes.com/2012/02/13/technology/start-ups-aim-to-help-users-put-a-price-on-their-personal-data.html/ http://www.nytimes.com/2012/02/13/technology/start-ups-aim-t...
DigitalSea 13y ago
Losing information on the scale these guys have is no doubt going to be bad for their reputation.
pentarim 13y ago
Bad reputation
xntrk 13y ago
Seems like a good letter to send for a fishing scam. Call this number that has nothing to do with our company and give them more personal info to "watch your credit".
Cherian_Abraham 13y ago
Ironic. More over, this is exactly why AirBnB should not become an identity store (asking their customers to become verified by scanning and sending their passport info). I do not trust them with my identity.

63 points by chunsaker 13y ago

jorts 13y ago

Is there a reason why in all of these compromises that they never state the type of encryption used on passwords?

dangrossman 13y ago
Because somewhere between 97% and 100% of the recipients of the message would only be confused by that information.
- whatshisface 13y ago
  Confusion, when followed by positive words, can make people happier sometimes. (Wow, I sure am glad they are so smart!) I don't really see a big drawback to inserting a few extra words, if those words might get reputable people to say that the bad thing that just happened wasn't really so bad.
- floody-berry 13y ago
  It seems more likely that they don't realize it's even important until they get hammered for details on what they used. Some PR person asks an engineer and he says "Yeah, it's fine, we hash/encrypt the passwords.." and only after they eventually disclose what they were using and have it explained to them do they realize they screwed up.

lucian303 13y ago

"That said, pointing out to users that you don't have to tell them when you've been breached might not make you any friends." Well, one state is enough. The news would have gotten out anyway from the North Dakota customers. Otherwise, there is no doubt they would have kept it under wraps.

iancarroll 13y ago

It's gonna need some reputation defense now.

lstamour 13y ago

I'm always nervous when people say they've lost "encrypted" passwords. We need a "plain english" version of https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet or at least issue a warning when you create a "password" VARCHAR in MySQL ;-)

tptacek 13y ago
I really hate that OWASP page (it's not as bad as it used to be --- that is, godawful --- and now it's just incoherent) and think we shouldn't be directing developers to it. If there's something "OWASP" (whatever that is) is truly bad at, it's cryptography.
- ineedtosleep 13y ago
  I usually rely on OWASP for general guidelines, but if that page isn't enough for you, what is? (not a rhetorical question) What should one look into in order to fill in OWASP's gaps?
- gcr 13y ago
  What things would you change?
- gcr 13y ago
  What's wrong with it?
kijin 13y ago
> issue a warning when you create a "password" VARCHAR in MySQL I put my salted and bcrypt'ed passwords in a CHAR or VARCHAR column named "password". Anything wrong with that? Should I change the name of the column to something like "hashed_password"?
- aptwebapps 13y ago
  The name of the column isn't a problem, rather it's an opportunity to nudge the developer a bit. Or that's how I read the GP's comment.

superflit 13y ago

So their reputation is lost?

joshguthrie 13y ago
When I first read the title, I thought they litteraly LOST their database contents.

useflyer 13y ago

Its absolutely flabbergasting when a company, which has the sole purpose of protecting customer information, allows this to occur. They've raised 4 major institutional rounds (their last $42 million), its discomforting that neither their team nor investors thought to secure their systems better than this.

sneak 13y ago
mumble mumble invisible hand mumble
- skrebbel 13y ago
  I didn't get it.
  - Bill_Dimm 13y ago
    I think his point is that in an efficient market (invisible hand - an Adam Smith reference) incompetent companies should loose all of their customers to better companies and die.
    - skrebbel 13y ago
      Thanks! I didn't know it was an Adam Smith reference. It makes sense now.
Hitchhiker 13y ago
" That is a funny business because on a net basis, the whole investment management business together gives no value added to all buyers combined. That's the way it has to work. " - Charlie Munger ( http://ycombinator.com/munger.html http://ycombinator.com/munger.html )
furqanrydhan 13y ago
I worked there as one of their first engineer's, It's surprising to me that they've raised that much $, however the hack isn't. Incompetence is a word I use fairly when describing my time there...

electic 13y ago

This is really bad for their reputation.

brandon_wirtz 13y ago

Reputation.com has always been smarmy. It wouldn't surprise me if they sold the passwords and then claimed they lost them. (Really) For the things Reputation.com does you have to ask why they used encrypted rather than hashed passwords. Not that hashed passwords would make me super excited to be lost, but why did Reputation.com need to keep the password around? They don't really interact with accounts, and if they do those should be stored separately from the access to the site. So the message should have been "we lost users bank account passwords" or something along those lines. Because I know that Reputation.com is practically in the extortion business this password storing rather than hashing issue makes me think even less of them, which is difficult to do.

tekacs 13y ago
The passwords _were_ salted and hashed (the article and e-mail screenshot both mention this). It's no s/b/...crypt but they don't seem to have been 'kept around'.
- tekacs 13y ago
  Aaand having posted this, he reads the first comment on the page which states the opposite... in contradiction to the posted screenshot of the supposed e-mail. o_O
  - chunsaker 13y ago
    I received and posted the email, and many others on twitter have also received it. Also, not sure we should take blog comments for the gospel before all the facts are out.
just2n 13y ago
As a friendly tip, this isn't your YouTube comments page for why Node.js is stupid, so we'd appreciate it if you would take the few minutes of your time and read the article before jumping to conclusions or stating facts without credible sources.
- 13y ago

bredren 13y ago

This article sort of glosses over the exact user data lost in the data breach: names, email and physical addresses. For users some, phone numbers, date of birth and occupational info. That is a lot of personal data to lose given Reputation.com's supposed to be opening a data privacy vault this year.[1] The founder gave interview to Fox March 1st describing Reputation.com's move into vendor relationship management.[2] Advocates for personal data vaults / VRM business model[3][4] like Reputation.com and Personal.com stress that personal data is mishandled today, especially by data brokers. Thus it must be particularly frustrating for Reputation.com to be directly involved in a data breach. [1] http://www.nytimes.com/2012/12/09/business/company-envisions-vaults-for-personal-data.html?pagewanted=all http://www.nytimes.com/2012/12/09/business/company-envisions... [2] http://www.reputation.com/reputationwatch/multimedia/michael-fertik-fox-markets-now-data-vault http://www.reputation.com/reputationwatch/multimedia/michael... [3] https://cyber.law.harvard.edu/projectvrm/Main_Page https://cyber.law.harvard.edu/projectvrm/Main_Page [4] http://www.nytimes.com/2012/02/13/technology/start-ups-aim-to-help-users-put-a-price-on-their-personal-data.html/ http://www.nytimes.com/2012/02/13/technology/start-ups-aim-t...

DigitalSea 13y ago

Losing information on the scale these guys have is no doubt going to be bad for their reputation.

pentarim 13y ago

Bad reputation

xntrk 13y ago

Seems like a good letter to send for a fishing scam. Call this number that has nothing to do with our company and give them more personal info to "watch your credit".

Cherian_Abraham 13y ago

Ironic. More over, this is exactly why AirBnB should not become an identity store (asking their customers to become verified by scanning and sending their passport info). I do not trust them with my identity.