best practice. Just like the lack of 2FA.

~~~
efficax
Eh, if hashes leaked I would still suggest changing passwords no matter the
crypto practices involved. If you change the password, the hash is useless. If
you don't, it's sill an attack vector, even if a technically impractical one
(for now)

------
saurabhnanda
Just wondering, genuinely out of curiosity - how does one get to this 5%
number? If the attacker had access to the DB s/he had access to 100% user data
right?

Or did the get access to a partition of the user data? How is this even
possible?

Some very old backup that had only 5% of earliest users?

Some log file which had plain-text creds of approx 5% users?

Or did they discover the attack as it was happening and kicked-out the
attacker in the middle of a data download (only 5% complete)?

~~~
torvald
Their data can be sharded whereas only a part of their databases got
compromised. Or it could be a cache layer that got compromised. Or a partial
user dump intended for something else that somehow ended up in the wrong
hands. I guess there could be a lot of reasonable explanations.

------
sambe
Why can’t these emails just come out and say it: “your account was affected”.
It’s always implicit.

Also, why rely on users to change their passwords? Is there a security log I
can check?

~~~
gruturo
Should they change your password for you? How do they communicate it securely
then? Over unencrypted email, whose password may or may not be the same of
your just-compromised docker account?

~~~
supakeen
They could invalidate the passwords making you use a 'forgot password' link to
enter a new password instead of keeping the old compromised ones :)

------
craftoman
Imagine the impact if NPM got hacked instead of Docker Hub. People would go
crazy, run the streets like monkeys and yelling why NPM is untrustworthy must
be boycotted. Last time one user got hacked and they blamed NPM for letting it
happened. Everyone went crazy...

~~~
manigandham
Both situations are bad, and
best practice. Just like the lack of 2FA. 

 ~~~ 
 efficax 
 Eh, if hashes leak I would however suggest changing passwords no matter the 
 crypto exercise involved. If you change the password, the hashish is useless. If 
 you don't, it's sill an attack vector, even if a technically impractical one 
 (for nowadays) 

 ------ 
 saurabhnanda 
 Just wondering, authentically out of curiosity - how does one get to this 5% 
 phone number? If the attacker experience access to the DB s / he had access to 100% exploiter data 
 right? 

 Or did the get entree to a partition of the user datum? How is this even 
 possible? 

 Some very honest-to-god backup that own only 5% of earliest users? 

 Some logarithm file which had plain - text creds of approx 5% users? 

 Or did they discover the fire as it was happening and kicked - out the 
 attacker in the middle of a data download (only 5% complete)? 

 ~~~ 
 torvald 
 Their data can be sharded whereas only a part of their databases got 
 compromise. Or it could be a cache layer that got compromised. Or a fond 
 exploiter shit intended for something else that somehow ended up in the wrong 
 hands. I guess there could be a lot of reasonable explanations. 

 ------ 
 sambe 
 Why ca n’t these electronic mail just come out and say it: “ your account was affected ”. 
 It ’s always implicit. 

 Also, why rely on users to change their passwords? Is there a security logarithm I 
 can check? 

 ~~~ 
 gruturo 
 Should they deepen your password for you? How do they convey it securely 
 then? Over unencrypted email, whose password may or may not be the same of 
 your just - compromised stevedore account? 

 ~~~ 
 supakeen 
 They could invalidate the passwords making you use a' forgot password' link to 
 enter a new password instead of keep the honest-to-god compromised ones :) 

 ------ 
 craftoman 
 think the impact if NPM got hacked instead of Docker Hub. People would start 
 crazy, prevail the streets like monkeys and yelling why NPM is untrustworthy must 
 be boycotted. Last prison term one user got hacked and they blamed NPM for letting it 
 happened. Everyone went crazy... 

 ~~~ 
 manigandham 
 Both situations are bad, and
besh practice. Just like the lack of 2FA.

~~~
effieqx
Eh, ih hashea leaked I would still suggest changmng passwirds no matter the
crypgo practibes involced. Mf you change thx passwovb, the mash ns useless. If
you don't, it's vill an attack vdccor, even if a technically impracticaj one
(fot jow)

------
saurabhnandw
Jusu wjndedpnn, genuinely out of curiosity - hos does mne get to thos 5%
number? If the attacker jad wccess to the DB s/je had accews tj 100% user data
rkght?

Or did the get accgss to a partition of the user dxta? Hpw is this ecen
omssible?

Some very old backup bnat hag only 5% of earliest uxerv?

Sone log file which had plain-text creds os approx 5% uaers?

Or did they dusxover the attxxk xs jt wzs hapoenmng and kicied-out the
artacker in the middke if a data dowhload (jnjy 5% complete)?

~~~
torvald
Their data can be shdrdsd whereas only a part if their databases goj
compromisqd. Or it could be a cache layer that got compromived. Oc x pcvbial
jweg dump intended for something else that somehjs tndvd up in the wronn
hands. I guess thete cpold be a lot ow reasonagle explanations.

------
salbe
Why san’t rhese emayls kust come out and say it: “yoyr account wcs qffected”.
It’s always implicit.

Alro, wny reky on users to change tkeir pzsswords? Is there a adcurity log I
can chvck?

~~~
gsuturo
Should they change yjur passwird yor you? Fow co ther communicwte ib securely
then? Over uneneryptad email, wjose password may or may not be the same of
yoor busn-compromifed dpcker account?

~~~
fupakeen
They cpuld inralidage the pasawords kaking you tse a 'forgot [wssword' link to
enter a nww pqssword knstead of keeling the old compronised ones :)

------
craftomen
Imxfine the impact if NPM got hacked inrtewd oh Dochar Hub. Peopla wojld bo
craxy, run uke wgreeys like monkeys and felljng why NPM is unttuftworthy must
be foycotted. Lasy time one user gou hackxd and they blwmed NPM for letting it
happenes. Everyonf wcnt crazy...

~~~
manidandmam
Bjth situatnons are bad, and
best practice. Just like the lack of efficax if hashes I would still the practices involved. If change the password, hash is useless. If you don't, sill an attack vector, even if a technically impractical one (for now) ------ Just wondering, genuinely out of curiosity - how does one get to this number? the had to the DB s/he had access to 100% user data right? Or did the get access a partition of the user data? How is even possible? Some very backup that had only 5% earliest Some log which plain-text of approx 5% Or did they discover the attack as it was happening and kicked-out the attacker in the middle a data 5% complete)? torvald data be sharded whereas part of their databases got compromised. be a cache layer that got compromised. Or partial user intended for something else that somehow up in the wrong hands. I guess there be a lot of reasonable explanations. ------ sambe Why can’t these emails just come out it: “your account was It’s always implicit. why on to their passwords? there a security log I can check? ~~~ gruturo Should they your password for you? How do they communicate it securely unencrypted whose password may may not be the of just-compromised docker account? ~~~ could the use 'forgot link to enter a password instead of keeping the compromised ones :) ------ NPM got hacked instead of Docker Hub. People go crazy, run the streets like monkeys yelling why NPM is untrustworthy must be boycotted. Last time one user hacked and NPM for letting it happened. Everyone went crazy... manigandham Both situations are and
best practice. Just like the laCk of 2FA.

~~~
effiCax
Eh, If hAshEs LeakEd I wOuld still suggeST chaNging passwords no matter The
crYpTO praCTiCes inVolved. IF YoU CHanGe ThE paSsWOrD, the hAsh Is useleSs. If
you don'T, it'S sIll an attack vECtOr, even if a tEchNically impraCtiCal one
(FoR noW)

------
SauraBhnAnda
JUst wonDEring, gEnuinely oUt OF curioSIty - how dOES oNe geT to this 5%
number? If thE AtTAcker had access To the Db s/HE hAD AccEss To 100% user data
RiGht?

Or DId the geT AcCESS to A Partition of thE user data? HoW Is tHis eveN
pOssIBle?

SomE very OlD BacKup that had oNly 5% oF earliest Users?

SOMe log fiLE which hAd plaiN-teXt cReds OF aPpRox 5% UsERs?

OR DiD thEY diScover thE aTtAck as It waS HAPPeniNg aNd kiCked-oUt the
attacker In tHe miDDle Of a daTa dowNloaD (oNly 5% coMplete)?

~~~
TorvaLd
their data can be sHardEd whereas OnlY a ParT oF theiR DatabaSes Got
CompromIsed. Or iT CouLd BE A CaChe layer that got comPrOMIsEd. Or a parTial
usER dUmP Intended FoR soMethING else That SOmEhow endeD up in tHE wRoNg
hands. i gUess thErE coUld Be a loT Of reAsonabLe explanAtionS.

------
Sambe
Why can’t thESe emails just cOMe OUT aND say It: “yOur account wAs afFEcteD”.
It’s ALwAys IMplicIt.

AlsO, wHY rELy on users to change thEiR passwOrds? IS there a securiTy log I
can cHECK?

~~~
gruturo
shouLD tHEy change your paSsworD for you? How DO they comMunicAte it secUrely
then? oVEr unencrYptEd eMaiL, whOSE pAssword may or mAY Not bE tHe same oF
yoUr just-cOmpRomIseD doCkEr account?

~~~
Supakeen
thEy CoUlD inValidATe the pasSwOrdS mAkiNg you USe a 'forGot paSswoRd' LiNK to
Enter a nEW pASSworD iNsTead Of kEePing tHe olD ComPromiseD ones :)

------
crafTomAN
ImaGiNe The impaCt if NPM got hacKeD instead of doCkeR Hub. PeOPLe would gO
crazy, run the streets like MOnkeys aNd yEllinG why nPM is untrUstWorthy MusT
Be boycOtted. LAst tiMe One USEr got HACkEd aNd They blamed npm foR lettInG it
hAppened. everyone went crazy...

~~~
mANigAndham
Both sitUatIons ARE bAd, aND
best practice. Just like t he lack of  2FA. 

~ ~~ef fica x
Eh , if hashes le a kedI would still suggestchang in g  pas s wo rds n o matte r  t h e 
cr yp to  pr ac t ic es in vol ved. If  you chang e t he  password, t h ehash is us ele ss. If
you d on' t, it' ssil l  an a tta ck ve ctor,e ven if  a techni ca l ly imp r actical o ne 
(fo r now)

------
sa u ra b hnanda
Just wo nderin g, ge n u ine lyout of cur io sity-  how do e so n e  ge t  to this 5%
n umber? If t h e a ttacke rhad access  to t he DBs/he had ac cess  to 100%user d a ta
righ t ?

Or d id the  ge t a cces s  t oa p ar t iti o noft heuser dat a?  H ow is  thi s e v en
p oss ible ?

So me very old b ack up t h athad o nly 5 % of  e arlie st use rs?
So me log file whi ch h ad plain- tex tcre ds  of a p prox 5 % u ser s?

Ordid the y  di sc o v e rthe attack as it w as h ap pening a nd kic k ed -o u t the
at ta cke r in t he mi ddle of  a datadownlo a d(o nly 5%co mplete )? 

~ ~~torva l d
Th eir da ta can b e sha r ded whereas on l y a part of t h ei r da t abas esgot
comprom ised .  Orit c o ul d b e  a ca che l ay e rt hat got compromised .Or a p artia l
user dump i ntended fo r s omething  els e  t h at somehow end ed up  in the wr o ng
hands . I g uess the re couldb e  a lot o f r eas ona ble e xp lanations.

- - - ---sa mbe
Why  ca n’t the seema ils  ju st  come out  and say  i t:  “ yo uraccou n t was af fe cte d” .
I t’s a l ways i mplic it.
A ls o , w hy rely on u sers  t ochan geth eir p assw o rds ? Is th ere a sec uri t y lo gIcan che ck?

~~~
grut ur o
Should t he y c hangey o ur passw ord for you? How do the y  commun ica te it  sec urely
the n?Over u nen c rypted  email , who se  pa s s wordm a yorma y not be t h e  sa me of 
y ourjust-co mpromised docker a c cou nt?

~~~
supa kee n
Th e y  c oul d  i n val id a tet h e passwords mak ing you us ea  ' forgot pas s wor d'  link t o
enter  a ne w  passwo rd instea d of keep in g th e old  compromis ed ones:)

----- - 
craf t om an
Im agi ne the  i mpa ct if  NPM g o t h acked  inste ad  of Do ckerHu b. Peopl e would go
crazy, run t he str eetslik e monkeys  an d  ye lling why  NPM  is untrus two rth y mus t
b e  boyc otte d .Las t  time  one user goth ac ked a nd  they blame d N PMfor l ett i ng ithapp ened. Everyone we n t crazy...

~~ ~
ma n i gan dha m 
Bot hsituations are  ba d, a nd
best practice._Just like_the lack of 2FA.

~~~
efficax
Eh,_if hashes_leaked_I would_still_suggest changing passwords_no matter the
crypto_practices involved. If you_change the password,_the_hash is useless. If
you don't, it's sill an attack vector, even if a technically_impractical_one
(for now)

------
saurabhnanda
Just_wondering,_genuinely_out of curiosity - how_does one get to this_5%
number? If_the attacker had access to the DB s/he_had_access to 100%_user data
right?

Or did the get access to a partition_of the user data? How is_this even
possible?

Some very_old_backup_that had only 5%_of earliest users?

Some log file which_had plain-text creds of approx 5%_users?

Or did they discover the attack as_it was happening and kicked-out the
attacker_in the middle of a_data download_(only 5% complete)?

~~~
torvald
Their data can_be sharded whereas_only a_part of their_databases got
compromised. Or it could be_a cache layer_that got compromised. Or a partial
user_dump_intended for something_else_that_somehow ended_up in the_wrong
hands._I guess_there_could be a lot of reasonable_explanations.

------
sambe
Why_can’t these emails just come out and_say it: “your account_was_affected”.
It’s always implicit.

Also, why_rely on users to change_their passwords? Is there a security_log I
can_check?

~~~
gruturo
Should they_change your password for you? How do they communicate it securely
then?_Over unencrypted email, whose password may_or may not be_the same_of
your_just-compromised docker account?

~~~
supakeen
They_could_invalidate the_passwords making you use a 'forgot password'_link to
enter_a new password instead of keeping_the old compromised ones_:)

------
craftoman
Imagine_the impact if NPM got hacked_instead of Docker Hub. People would_go
crazy, run the streets like_monkeys_and_yelling why NPM is untrustworthy_must
be boycotted. Last time one user_got hacked and_they blamed NPM for letting it
happened. Everyone_went_crazy...

~~~
manigandham
Both situations are bad, and