Javalobby

Gunnar Hillert is a Member of Technical Staff (MTS) at SpringSource, a division of VMware. He is a core committer for the Spring Integration project, and also contributes to the Cloud Foundry project. Additionally, Gunnar heads the Atlanta Java Users Group and is co-organizer for the DevNexus developer conference. Gunnar has posted 9 posts at DZone. You can read more from them at their website. View Full User Profile

Password Security and Hash Slippage

06.11.2012
| 1753 views |
  • submit to reddit

We Recommend These Resources

NOSQL for the Enterprise

The massive losses of password hashes at LinkedIn [1], eHarmony [2] and Last.fm [3] are very concerning, to say the least. These are companies that are generally perceived as technology leaders, particularly LinkedIn. Also, as far as I now, eHarmony and LinkedIn are Java/JVM shops. Just some data that I gathered today regarding the scope of the issue:
  • Last.fm - presumably up to 17 million lost hashes - Algorithm used: MD5 - Hashes were Not salted
  • eHarmony - 1.5 million hashes - MD5 - No salted - All upper-case-passwords
  • LinkedIn - 6.5 million hashes - SHA1 - Not salted
Some of the leaks supposedly happened as far back as 2011. Here is some further background information:  What is quite amazing to me, is that the basic measures that would prevent the cracking of the hashes, like better hash algorithms, salting, re-hashing are not rocket science. There is even a very nice library [4] out there that does it for you and it even hooks into e.g. Spring Security [5] - Not even Java coding is necessary.
I just wonder how the hackers got access to the hashes in the first place...I could not find any information on that, yet. Maybe another juicy story...
[1] http://blog.linkedin.com/2012/06/09/an-update-on-taking-steps-to-protect-our-members/
[2] http://advice.eharmony.com/blog/2012/06/07/updates-on-ongoing-efforts-to-protect-our-members/
[3] http://blog.last.fm/2012/06/08/an-update-on-lastfm-password-security [4] http://www.jasypt.org/ [5] http://www.springsource.org/spring-security
Published at DZone with permission of its author, Gunnar Hillert. (source)

(Note: Opinions expressed in this article and its replies are the opinions of their respective authors and not those of DZone, Inc.)

Comments

Fahmeed Nawaz replied on Tue, 2012/06/12 - 10:21am

I've just discovered MongoDB and wanted to git it a try using the official java driver.

I have a problem though: I want to change the default Mongo data directory ( /data/db) to something else in my java application.
I searched the javadoc but didn't find how to do this.

Could you please help ?
Many thanks

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
"Starting from scratch" is seductive but disease ridden
-Pithy Advice for Programmers