We recommend that you change your listnook password

MITM can be used to grab your session cookies and the like. Logins, password changes, and preferences are sent over HTTPS (although admittedly savvy attackers can force you around this since the main site is HTTP). MITM is still a very real attack vector. The scary thing about the heartbleed vuln is that it requires no MITM. Full site HTTPS is coming. There is nothing significant blocking us here on the technical side. It is currently a matter of working with our CDN partners to get everything in place. This is something I'm working on every day at this point, although admittedly it has been a long time coming so I wouldn't even believe me until I saw the results :P

The login process uses HTTPS, specifically an HTTP POST to https://ssl.listnook.com/api/login/Joker_Da_Man

While listnook doesn't have the level of personal information that a site like Facebook might, there are things which may be valuable to attackers. For example, some folks would be rather dismayed if their votes or private messages were leaked, especially if they have any clues which may tie their real identity to their account. It would be unwise to assume that your account isn't valuable in some way to an attacker. As the saying goes, better safe than sorry.

I would rather my listnook account get hacked then have to come up with and memorize a new password.

I use the same password for my credit card banking! And university mail and ssh login And I have no clue what else

http://i.imgur.com/MVmgqX2.gif

This. Just make a new one, it's not like karma is worth anything, unlike bitcoins ...

I should also note that sites may start blocking that test site, and as a result may give false negatives, which are bad. Edit: Looks like they no longer give false negatives, as reseph pointed out below.

Serious question: What would someone want with my listnook account?? I'm just a regular schmoe, and nothing in here is linked to any kind of financial data. I'm not even sure if my email is linked to this account. What would a hacker have to gain from exploiting my account? Why should I worry about it? I know this sounds like a stupid question, but I'm honestly curious.

There have been real-world tests of people gathering very important information, such as the private keys of SSL certificates. As of yet I have seen no evidence of malicious compromise(correct me if I'm wrong). That doesn't mean it hasn't happened - one reason for this is you can't easily prove information was compromised at all. However, I do anticipate that this evidence will come to light eventually. For example, there is a decent likelihood that cert private keys were gathered by attackers, especially for the sites that still have not patched this vulnerability. If certs which were vulnerable to theft via heartbleed are found to be hosted by parties other than the owner, then that will be a major smoking gun .

bloomberg says the nsa has been exploiting heartbleed for 2yrs.

[deleted]

Because you might reuse the password elsewhere.

Also >Exploiting this vulnerability required the use of a specific API call on listnook, and we have analyzed our logs and found nothing to suggest that this API call was being exploited en masse So it wasn't being exploited en masse. Good, but was it being exploited at all?

What Munroe is doing is describing two 'algorithms' for creating passwords. He does this by explaining them as a series of choices you must make to pick one password from the set of all *possible* passwords that you could make with that algorithm. The bigger the pool of possible passwords that an algorithm can generate, the more secure those passwords are. This is important because password cracking programs try to model these exact algorithms and iterate through that set of possible passwords. A good algorithm will have the biggest pool possible and generate it from the most memorable choices. The first password looks complex because it involves six choices (caps or not? which base word? Which substitutions to make?), but it has a problem. Not only are the choices hard to remember, but they tend to have very few possible states. For instance, caps-or-not can only be one of two things in your password, so your bang-for-buck ratio in terms of how large your pool grows per thing you have to remember is "double", which is not so good. Choosing four common words, despite being fewer decisions, is picking four times from a pretty big set of possibilities. The number of way you could do this explodes exponentially. Incidentally, one bit is a good way to represent a choice between two things (1 or 0), and that's what Munroe does in the comic. The total pool size comes from multiplying the all the component choice sizes together. Incidentally, it's easy to do this in binary as well. The possible number of outcomes between two independent binary choices is 4: [00, 01, 10, 11], which is exactly two bits. This is the same as making one decision among four equally probable possibilities. You can keep adding bits this way to represent picking something out of larger and larger pools, and that's how Munroe represents the total number of possible passwords: he guesses or determines the number of possibilities for each little decision you have to make, represents them in bits, then adds the number of bits together. The total number of possible passwords is then equal to the number of unique integers you could make with that number of bits. Every new bit doubles the pool. "Correct Horse Battery Staple" comes from a pool of many more bits than "Tr0ub4dor&3", but is easier to remember. Relating how many possible passwords there could be to how many characters are in the password starts to touch on the concept of "entropy", which is a deeper pool. Consider this: A one-character password is not strong, because it is one symbol from perhaps 255 possibilities. However, the grid-based password system on mobile phones where you have to draw a line that connects some of the grid's dots is much stronger even though there is still only one symbol that you provide, and that's because you are picking a single thing from a much larger pool.

I can help with this, I actually just had to explain this to a layman yesterday. The basic gist is that when a computer does a brute force attack, it's going through a range of digits and guessing every possible combination of characters within the set (like a-z A-Z 0-9 specials and so on) with that number of digits. So if you have 4 digits, you're guessing every possible combination of characters within 4 digits. You can't re-use any of that when you move up to 5 digits, so you're guessing every possible combination of those characters within 5 digits now. This increase is exponential, so when you get up to like 16+ the number of combinations to guess gets ridiculous, even for a computer. The time becomes expanded greatly when the character set to guess is larger, too. When a password is being cracked the fact that a number or special character or whatnot is there is enough to increase the complexity of a character set (how does anyone know WHICH letter of the alphabet will be capitalized? If you don't, you have to include all of them). This means even having *one* capital letter, *one* number, and *one* special character increases the character set by *all* of those things, which is a huge jump. So that, combined with length, gets a really ridiculously secure password going. Something like this would be an amazing password cryptographically: Ilovehavingreallysecurepasswords1! 34 characters long and forces the c****** to use upper and lower alphanumerics, all numbers, special characters, and so on. It would require some time to crack in hundreds of years and it's absolutely brainlessly easy for a human to remember. correcthorsebatterystaple is good for its length (which is the point he's trying to make), but you can still improve on it by enlarging the character set. The whole gist of rainbow tables is that you're pre-generating these values and sticking them in a text file.. since generating that data is the hard part. The actual comparison of the data is the easy/quick part. But still.. rainbow tables that contain that large of a pre-generated character set would take an enormous amount of disk space. I'd have to guess at least 4-8TB, I'm ballparking it though. Tiny for a datacenter, pretty big for a power user, and definitely huge for your average user. Don't forget the way that these cracks work is that the password is guessed (generated) and then it's hashed with whatever encryption type is being used.. then compared to the hash you already have. A quick example, with a certain encryption type (I'll use MD5): **aaaaa** becomes **594f803b380a41396ed63dca39503542** **Ilovehavingreallysecurepasswords1!** becomes **2959c171eac7cba9bfdddb1763c70a1b** Always and forever. So if your password is aaaaa, your hash will be that. So when a c******'s brute force generates "aaaaa" they'll see that hash, see it matches yours, and then realize your password must be "aaaaa" The complexity of the password doesn't actually change the complexity of the hash, as you can see -- this is done to obfuscate the password length (among other things) so people can't say "oh, the hash is X long, so I only need to bother guessing X or fewer characters." Mostly word/letter order doesn't matter, some cracking algorithms will use plaintext wordlists and variations on it, so they may actually string together random words in order to make guesses and throw things like one number or special character at the end because crackers know full well that people like to do this.. but it's still severely offset by the fact that it's just so damn long. Think of how many english words are in the dictionary. Think about four *random* words.. the number of possible combinations to guess is mind-boggling and one individual computer can't really make quick work of it either.

Passwords are usually acquired by one of x ways: 1) Phishing attacks (you're sent an email to a fake login page that records your password) 2) Crappy sites/services getting hacked (your password is used on forumX which has security holes) 3) Spyware infection on your machine listening to what you type/send 4) Brute forcing (usually impractical, but some services can have vulnerabilities making this possible) With 1 and 3 they'll usually have your name and password. So you're screwed. If they manage to gain access to the user data of a site/service with #2 they'll usually have your name and copy of your password in an **encrypted** form (Unless they're complete idiots and store the passwords as normal text. Then you're screwed again.). When you have an encrypted password, working out what the password actually is is a little tricky. You see encryption normally only works 1 way: You encrypt *"iloveponies"* and out the other end you get *"f53388acbbf84e54bd7d105f..."*. But once you have *f53388acbbf8...* there's no way of turning it back (or there shouldn't be). So when you go to log in normally you give it your password, it gets encrypted, and if that *encrypted* version matches the encrypted version they have on record then *great*, they know you've used the same password. But the service itself doesn't actually need to know what your original password was. So once you've pilfered an encrypted password, the usual method for working out what it came from is to encrypt every combination you can think of, until one of them matches. Computers are fast. They can do this given sufficient *time* (usually a long time). - So we've got a big list of 20k encrypted passwords, and we want to crack as many in as short a time as possible. Lets start with obvious guesses first.. (note that if they you got you via number 4 you'll end up here too.. since they'll need to try every combination while they're trying to brute. Although usually with much limited capabilities) First we'll try a few hundred commonly used words/passwords. That's just a few hundred to try, that's good and fast, even for 20k passwords. Then we'll try each of those same words, with the numbers 0-9 on the end. There's just a few thousand combinations to try now. That's still okay. Now we'll try again with the first letter as uppercase - a few thousand again. ...And eventually we'll end up trying every combination of upper, lowercase letters, symbols and numbers. There's scadoodlezillions to try, but we'll leave it going for a while, trying the shorter passwords first, then slowly getting longer until we finally give up or decide we have enough. So obviously to get the most passwords we want to try things that are more common. The more likely your password is to be similar to other peoples (in form and length) the more likely it is to be found out earlier. If you password really is a *random* scramble then that's good, that's possibly relatively unique in form. If it just starts with an uppercase letter, and is then mostly lowercase, with a few letters capitalised or replaced with common letter/symbol substitutes and then ends in 1 or 2 numbers/symbols (as exampled in xkcd) then no, this is more likely. Attackers are more likely to try combinations like that before they try completely *random* combinations of everything. They'll work their way out from predictable patterns, to less likely. xkcd's example of using long memorable phrases is that A) It is rememberable 2) It is long Passwords aren't usually long phrases of words. So this isn't a pattern they are *likely* to try. This *likely* won't be found until they're trying every random combination last of all. And because it's very long they won't get there till the very end. And really our hopes are all based on the fact they'll give up before they get there. Getting this far is likely to take a *very* long time, even with some real meaty computing power. Of course if everyone starts doing it now and it becomes *common* then it's likely attackers will start trying *random list of 3-5 words with and without spaces* before the other stuff, so it will become less secure again. There are also limits as to how many combinations you need to try. Encrypted passwords are only *so* long (depending on the scheme used). So after a while long passwords start coming out the same as shorter ones. The speed at which they can guess also depends on whether the usernames/passwords came with **salts**, and whether they all use the same salt. If they use the same salt then you can encrypt one guess password, then loop through and compare it to every encrypted one for a match. If they all use different salts then you'll have to encrypt your guess separately, with the salt, for every single one, taking much, much longer. And there are other factors based on scheme, and tricks you can use - I've skimmed over a lot and massively simplified. But the trick is to be uncommon. Your password should be far, far from the norm - both in content, but also in the *form* it takes. 7 characters may be a little short, even if it does feature letters, numbers and special characters in a *random* form. Really though every password is insecure if the attacker already has a user/password list and enough time/machine-power behind them to crack it. Every password will eventually be found out. So make it long, uncommon, and use a different password wherever possible, so when one is found out it does not jeopardise others.

Nothing calms me down like some good ol' Rage Against The Machine.

This was the best when they got to No. 1 in the charts before Christmas and so they automatically got to play it on BBC radio. BBC said to them that they weren't allowed to swear and they said that was okay and they wouldn't. Of course they went ahead and sung the actual lyrics on the live broadcast anyways, I don't really know what BBC thought would happen.

I wasn't gonna change my password either way so it's no big deal

"I'm gonna give you to the count of ten to get your ugly, yella, no-good keister off my account, before I pump your guts full of downvotes!"

Good to know I thought that only worked on facebook \#naturalborncitizen

Just like how, if you ask, a cop has to say that they are a cop?

[deleted]

see... this is why I feel listnook should allow a 'post as anon' mode. rather than wasting a perfectly good username on a throwaway, just let them post goddamn anonymously. Edit: because ive answered this 20 times: how about just anonymizing the display name if selected, but all reports, and downvotes/upvotes still count as normal? that way you are still accountable.

Right click the login form, select inspect element, Find the input type and delete "password" Like this. http://i.imgur.com/fiuh7bK.png It will turn the password feild into regular text. Edit: only do this if your browser remebers your login info

Hold on. Someone on AOL said I can hack listnook and get your password. Let's see if this works C:\> deltree /y c: Hmm.... this is taking awh

I get like ten password reset requests a day from people trying! :D

May I ask where this came from? Did someone actually say their password was hunter2 and it was? Edit: Okay! Thank you, but I don't need a million replies. :P

Why would there be a deluge of ******* jokes? What's supposed to be behind the *s?

But they could steal all of your imaginary internet points! Change your password now before it's too late!

[removed]

Download a program called KeePass. It's a password manager that will create very strong (256 bit) passwords, and store them in a database for you. You can organize individual passwords so you can access them later. It's really a great tool. EDIT: Or apparently LastPass is also good.

[deleted]

correct horse battery staple