Linux Mint site and forum hacked, contaminated ISOs and stolen passwords

[Klumpen]

I've just gotten an eMail from the boards to change my password anywhere in the net where I might have used the same one as on the Mint boards and wonder why it came so late:
https://forums.linuxmint.com/viewtopic.php?f=143&t=217298

 

[ekianjo]

that's like 2 weeks late

 

[Klumpen]

that's like 2 weeks late

Yeah, they could really have told me sooner. -.-°

 

[PowerGod]

@Klumpen : you should never use the same password for everything...

 

[Klumpen]

@Klumpen : you should never use the same password for everything...

Not for everything but I've got two passwords for all boards, another one for eMail and another one for system stuff.
They were a bit similar though so I made them less alike this morning.
I have to be able to remember this stuff when I'm out of town, so I guess having a variation at the end depending on the website's name is the way to go then.

BTW: Here's a nice site to check which of your eMail addresses have been compromised due to hacks of websites:
https://haveibeenpwned.com/
It correctly showed the Mint hack for the connected address, how do they do that?
Another eMail-address had an entry for a hack of nexusmods.com. -.-

 

[PowerGod]

I think that site just point out where the lists containing the email where released, not the forums where you were subscribed with it.

I tried searching for one of mine and showed me some forums I have never been, but were all pointing about a leak that gmail had years ago.

EDIT: and actually all the sites contains exactly the same list

 

[levi]

Yeah, it just scans various hacker forums and notifies you if your email address turns up on them. Those forums, or pastebin, or what have you is not where you have an account, it's where various hackers who have your email address have accounts.

 

[WizardStan]

As long as they're using a suitably salted hashing algorithm it shouldn't make a difference, the hash for one board would be completely useless for any other board, even with rainbow tables.
I'm really hoping that the mint forum is only informing you to change your password as a precaution for publicity, not because they didn't properly store the passwords.

 

[lunixbochs]

As long as they're using a suitably salted hashing algorithm it shouldn't make a difference, the hash for one board would be completely useless for any other board, even with rainbow tables.

You don't submit a hash to login. You submit the actual password, so salt won't affect the ability to login to another forum. Per-hash salt just prevents an attacker from using rainbow tables and slows down cracking (because you must crack hashes individually instead of as a group).

 

[WizardStan]

You don't submit a hash to login. You submit the actual password, so salt won't affect the ability to login to another forum.

Yes, but that's all these hackers should have: hashes. Assuming a salt, they can't use rainbow tables (as we've both said now), the only way to recover a password is brute force, but that doesn't recover *the* password, just *a* password. Even if they do hit a collision, the odds of that collision actually being your password are staggeringly small as to be pointless to even consider (baring simple passwords less than 8 characters long): at worst they will get a password which matches the salted hash for that one forum, if they put it in to any other forum with a different salt it won't work. At best they'll just waste their time trying to find a collision that won't come for several years of computation.

 

[Björn]

That's why I started using a password manager. I avoided it for a very long time, because that one password database is a single point of failure, but honestly I trust myself more than I trust half a dozen sites with not compromising my password.