We're still not sure how it even happened.
  • SketchySeaBeast@lemmy.caEnglish
    141·
    2 days ago

    I hate articles like this. Given I am 99% certain Steam will not be storing my password in a compromisable way, what is the point of changing it?

    • jmankman@lemmy.myserv.one
      10·
      2 days ago

      ‘Meanwhile, SteamDB has flagged a LinkedIn post from Dr. Christopher Kunz, a security writer at German tech site Heise, who wrote in an article on the alleged breach: “The dataset contains phone numbers and (expired) one-time codes, but no references to access data such as usernames, Steam IDs, or even password hashes. Whether Steam customers should now change their passwords as a precaution or install the ‘Steam Guard’ security app seems at least questionable.”’

      https://www.vg247.com/steam-vendor-data-breach-passwords-89-million-users-dark-web

    • twinnie@feddit.uk
      6·
      2 days ago

      They’re selling the data for $5,000. There absolutely won’t be passwords included.

    • x00z@lemmy.worldEnglish
      3·
      2 days ago

      You should never think hashed passwords are safe by default. Your password strength is probably the strongest factor on whether or not they can crack it. Your “hunter2” password can get cracked in a second.

      • SketchySeaBeast@lemmy.caEnglish
        2·
        2 days ago

        Well, no, but if they were plaintext it wouldn’t matter what they are. Regardless, I’m sure they are hashed and salted, and I’m not worried about my unique 64 character password being compromised by a dictionary attack.

        • groet@feddit.org
          2·
          2 days ago

          Yeah you and the other 0.1% of users with strong, unique passwords are save.

          I’m sure they are hashed and salted

          I wouldn’t. I have seen enough password databases to know everything from cleartext, base64, md5, encrypted with a key stores in the same database, pbkdf2 to argon2id is used in real world applications.

    • Showroom7561@lemmy.ca
      55·
      2 days ago

      Given I am 99% certain Steam will not be storing my password in a compromisable way,

      From what I understand, these passwords (and the accounts they are linked to) are in a usable form to whoever is buying the lists.

      2FA protects you, but changing your password isn’t a bad idea (and should be done on a regular basis anyway).

      • Dubiousx99@lemmy.world
        10·
        2 days ago

        Latest NIST guidance no longer recommends password rotation, except in the instance of a suspected system compromise. Regularly forcing users to update passwords leads to more insecure storage mechanisms and passwords as users just recycle new versions of old passwords.

        • Showroom7561@lemmy.ca
          33·
          2 days ago

          NIST guidance no longer recommends password rotation

          What’s the reasoning? Quantum computing will make brute force hacks significantly easier with less time, and rotating passwords “resets” the clock on these attacks.

          Regularly forcing users to update passwords leads to more insecure storage mechanisms and passwords as users just recycle new versions of old passwords.

          Users not using best practice isn’t a good enough reason to not recommend best practice. A password manager can handle password changes with ease (no need to reuse a password or insecurely store them), and coupled with 2FA, it’s just a solid plan.

          But I would still be curious to know why password rotation is not recommended.

          • PlantJam@lemmy.world
            5·
            2 days ago

            Password rotation leads to password reuse. If you can remember or type your password, it could be stronger. Randomly generated long passwords, different for every account, should be the bare minimum these days.

            The above has been my password advice for quite a while now. Please correct me if it’s no longer considered best practice or if I’m missing something important.

            • Showroom7561@lemmy.ca
              12·
              2 days ago

              Password rotation leads to password reuse.

              That’s a user problem, though.

              Randomly generated long passwords, different for every account, should be the bare minimum these days.

              Randomly generated phrases with separators, punctuation, and numbers, appear to be the strongest (and easier to type out if you are reading it off a password manager not on the same device). Just a random generated string is actually quite easy for a computer script to brute force, but so much of a pain in the ass for the user! LOL

              Length is usually better than complexity!

              For example, Bitwarden’s password strength test tool says this password would only take 3 years to crack (using today’s technology): s#y7s8a63@22

              While this one would take centuries: this-is-way-stronger

              Which one you would want to enter into your TV set when you have to log into a streaming video service? 😂

              • Dubiousx99@lemmy.world
                2·
                2 days ago

                Sure you can blame the user for their failure, but your systems will be less secure because of all your users who are not doing what they are supposed to. So then you have to decide, do we punish these users for their bad password practices or do we implement different practices that are more likely to be followed.

                Something you know isn’t the best method to verify identity anyways; as evidenced, it is easy for someone else to learn that information. Using something the user possesses is a much better choice as the user is more likely to be aware of a loss of the object and report the security incident.

                • Showroom7561@lemmy.ca
                  1·
                  2 days ago

                  So then you have to decide, do we punish these users for their bad password practices or do we implement different practices that are more likely to be followed.

                  In most areas, I would agree that the latter would be the best approach, with nuance*

                  However, in the security space, I would argue that you should implement practices based on the threat model, and the importance of the data being protected.

                  Should a user be rotating passwords on a website they use to check the weather? Probably not.

                  For a banking site? I would, and enable 2FA if it already isn’t. 2FA, I would also argue, is more of a PITA for users than picking a strong password via their password manager.

                  • We already see harmful example of suggestions being offered, not because the facts support it, but because “it’s easier for the user to follow”.

                  For instance, health authorities tell people to get 150 minutes of activity per week, despite the clear evidence that more than that would be better for optimal health.

                  Why do they do this? Because suggesting the true amount of exercise needed causes an aversion… the opposite effect.

                  So, I can see how we might ask users to only do the bare minimum, or else risk complete noncompliance with best practices. But the reality is, it only takes a very minimal amount of effort to secure our data, so we should encourage users to actually follow best practices (as it relates to their threat model).

          • Dubiousx99@lemmy.world
            2·
            2 days ago

            On mobile so forgive any formatting, but the text below is quoted from the NIST faq. https://pages.nist.gov/800-63-FAQ/#q-b03

            • Q-B05:

            • Is password expiration no longer recommended?

            • A-B05:

            • SP 800-63B Section 5.1.1.2 paragraph 9 states:

              “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.”

              Users tend to choose weaker memorized secrets when they know that they will have to change them in the near future. When those changes do occur, they often select a secret that is similar to their old memorized secret by applying a set of common transformations such as increasing a number in the password. This practice provides a false sense of security if any of the previous secrets has been compromised since attackers can apply these same common transformations. But if there is evidence that the memorized secret has been compromised, such as by a breach of the verifier’s hashed password database or observed fraudulent activity, subscribers should be required to change their memorized secrets. However, this event-based change should occur rarely, so that they are less motivated to choose a weak secret with the knowledge that it will only be used for a limited period of time.

            • Showroom7561@lemmy.ca
              2·
              2 days ago

              memorized secrets

              When those changes do occur, they often select a secret that is similar to their old memorized secret by applying a set of common transformations such as increasing a number in the password.

              Well, there’s the problem. Why are people using memorized passwords? And why are they picking passwords that could be easily guessed?

              Literally, the only password that one should memorize is for their password manager that has strong 2FA enabled.

              This recommendation seems to cater to users who already have poor security habits, rather than offering best practices. That’s my opinion, anyway.

              edit: spelling

        • Showroom7561@lemmy.ca
          1·
          2 days ago

          It depends. If your accounts are set up to auto-reject and ban people after X number of failed logins, then a strong password (even without 2fa) should be ok for most people.

          But if the service allows for unlimited login attempts, having the same password for months or years gives more time to brute force guess it.

          Even in a leak like this, even without anything more than a list of passwords, it could be a valuable collection for a “dictionary password attack”.

            • Showroom7561@lemmy.ca
              1·
              2 days ago

              Lots of unknowns, but this was a “leak”, rather than a “hack”. Perhaps another article might shed more light into the details of the data, and in what form those passwords are in.

      • SketchySeaBeast@lemmy.caEnglish
        2·
        2 days ago

        I hear that being said, but how? If Steam is following best practices of the last several decades, which I’m sure it does, it doesn’t have the passwords in usable form.