Ashley Madison's password "security" just keeps getting worse
Interesting article about just how bad the security was (is?) on the AM website. To summarize:
If the setting was a nearly impenetrable vault preventing the wholesale leak of passwords, the programming errors—which both involve an MD5-generated variable the programmers called $loginkey—were the equivalent of stashing the key in a padlock-secured box in plain sight of that vault. At the time this post was being prepared, the blunders allowed CynoSure Prime members to positively crack more than 11.2 million of the susceptible passwords.
This reminds me of my 84-yo uncle's password security. He has a different password for every online account, and he changes them regularly. (He's scheduled the change dates into his Google calendar.) However, because he can't remember them, he keeps them all on post-its stuck to his screen. To his credit, the account names are slightly cryptic (eg, one of his notes says something like thatoldstock=58@MYmoney). Nonetheless, if someone were to break in, they'd have all the info right there. Of course, given that his computer is almost as old as he is, the would-be thieves would be caught long before they could sign in.
http://arstechnica.com/security/2015/09/once-seen-as-bulletproof-11-million-ashley-madison-passwords-already-cracked/
= new reply since forum marked as read
