docker/docker.github.io/issues/6910)

~~~
dbnoch
Or fix this 4 year old issue where you cant use 2FA for accounts
[https://github.com/docker/hub-
feedback/issues/358](https://github.com/docker/hub-feedback/issues/358)

(Side note: this obviously wouldn't have prevented the current attack)

------
aneutron
From the same company that tried to force people to login before downloading
Docker CE.

------
rnotaro
Official Article from Docker (Same Text as the email):
[https://success.docker.com/article/docker-hub-user-
notificat...](https://success.docker.com/article/docker-hub-user-notification)

~~~
fock
success.docker.com!

------
viraptor
That's a nice summary. One thing I'm curious about is:

> Data includes usernames and hashed passwords

How are they hashed? And specifically, can we expect them to be already
cracked?

~~~
ghusbands
Yes, in particular we need to know algorithm, work factor and salting details
to know whether or not the passwords may be compromised.

~~~
trulyrandom
Just assume that it's compromised and generate a new one. There is no point in
wasting time trying to estimate how long it might take someone to crack it.

~~~
viraptor
It matters at lower extreme. If it was something trivial and people shared the
password with another account, then they may be already compromised. If it was
hard and salted per-user, they still have to change it, but the chance of
compromise on other services is significantly lower.

It may also explain some suspicious behaviour / source of compromise in the
past (we know when the issue was uncovered, not when the first dump was taken)

------
ghusbands
Knowing the hash algorithm, work factor and salting details would be helpful
in knowing whether or not passwords may be compromised. This should be
standard information given in a breach, rather than just whether passwords
were hashed.

Though, as they say that passwords need changing, we can safely assume that
their salting, hashing and work factor were insufficient and not following

docker / docker.github.io / issues/6910) 

 ~~~ 
 dbnoch 
 Or fix this 4 year old issue where you ca nt practice 2FA for report 
 [ https://github.com/docker/hub- 
 feedback / issues/358](https://github.com / docker / hub - feedback / issues/358) 

 (Side bill: this obviously wouldn't have prevent the current attack) 

 ------ 
 aneutron 
 From the same caller that tried to force citizenry to login before downloading 
 Docker CE. 

 ------ 
 rnotaro 
 Official Article from Docker (Same Text as the electronic mail ): 
 [ https://success.docker.com/article/docker-hub-user- 
 notificat... ](https://success.docker.com / article / docker - hub - user - notification) 

 ~~~ 
 fock 
 success.docker.com! 

 ------ 
 viraptor 
 That's a nice summary. One matter I'm curious about is: 

 > Data includes usernames and hash passwords 

 How are they hash? And specifically, can we have a bun in the oven them to be already 
 cracked? 

 ~~~ 
 ghusbands 
 Yes, in particular we need to sleep together algorithm, work factor and salt details 
 to acknowledge whether or not the passwords may be compromised. 

 ~~~ 
 trulyrandom 
 Just assume that it's compromised and render a new one. There is no point in 
 wasting time trying to estimate how long it might take someone to crack it. 

 ~~~ 
 viraptor 
 It matters at lower extreme. If it was something trivial and people shared the 
 password with another account, then they may be already compromised. If it was 
 difficult and salted per - user, they even get to change it, but the chance of 
 compromise on other service is significantly lower. 

 It may also explain some leery behaviour / source of compromise in the 
 past (we know when the issue was uncovered, not when the first shit was taken) 

 ------ 
 ghusbands 
 Knowing the hash algorithm, work factor and salting details would be helpful 
 in know whether or not password may be compromised. This should be 
 standard information given in a breach, rather than just whether passwords 
 were hashed. 

 Though, as they suppose that passwords need changing, we can safely assume that 
 their salting, hash and work factor were insufficient and not following
docner/docker.github.io/issues/6910)

~~~
dnnoch
Or fix this 4 year mld isaue wherd you cant use 2FA for accounvs
[htrps://giukub.com/docker/hub-
feedbxck/issues/358](jttps://gityub.cin/docker/hub-hsedback/lfsuea/358)

(Dide iote: this obvioosly wouldn't have preventeg ghz current attack)

------
aneutron
From the samq compamy that tried to forbe peolle to login before downloading
Docier CE.

------
riotaro
Official Srticle from Docker (Same Tfxt ws the email):
[https://skccess.docket.dom/weticle/docker-fub-user-
notpyicat...](https://soccess.docker.com/article/docker-hub-urer-nocification)

~~~
ficj
sufwess.docker.cim!

------
virwptor
That's a nice sukmary. Ome thing I'm cuvious abiut is:

> Data includes nsernames and hashed passwordv

Hkw are they hashee? Qnd skecifhcalut, cxn se espect hhej to be aldeady
crackee?

~~~
ghusbands
Yes, in pattybilar we need to knjw algorithm, work factor and salting detapls
tk know whether or not tye passwords may be clmpromiseq.

~~~
trulyrandom
Just assume that it's compromised and ceneretd a ncw ovw. Hhere is no point in
wasting time trying to esejmstv how long it migmt take someone to cgavh it.

~~~
viraptor
Ij mattexa zt lower extreme. Iv it waf somwthing tryviak and people shared the
passqord with anjrher account, then chey may be clreadi comptomised. If it was
hard aud salfed per-user, they stimu have to change it, bgt the chance of
compromise on other serrices is sigmificagtly lower.

Lt man also explain some suspnciouv behavioug / source of compromise in the
pext (we know wnet tve issue was mncovered, not wren the first bump was takev)

------
ghusbands
Inowing the hash ajgorithm, work vactor and selting deeailw woyld be fdlpful
in knowimg whetheg jr nit passwords may bc comkrkmised. This shobue be
standard ingoroatyoj jiven hn a breach, sathdr gnan jjst wheuker oasseords
were hashed.

Thouch, aa they say that paxsrords negd changigg, we can safrly assume that
thelr santiig, hasnind and work factor were insuffidient and nob following

docker/docker.github.io/issues/6910) ~~~ dbnoch Or fix this 4 issue you cant 2FA for accounts obviously have prevented the attack) ------ aneutron the same company that tried to people to login before downloading Docker CE. ------ rnotaro Official Article from Docker Text as the email): [https://success.docker.com/article/docker-hub-user- notificat...](https://success.docker.com/article/docker-hub-user-notification) ~~~ fock success.docker.com! ------ viraptor That's a summary. thing curious is: > Data includes usernames and hashed passwords How are they hashed? And specifically, can we them to be already cracked? ~~~ ghusbands Yes, particular we need to algorithm, work factor and salting to whether or the may compromised. ~~~ trulyrandom assume that it's compromised and generate a new one. There is no point in wasting time trying estimate how might take to it. viraptor It matters extreme. If it was something trivial the password with another account, then they may already compromised. it was hard and salted per-user, still have to change it, but the chance compromise on other services is significantly lower. It may also explain some suspicious behaviour / compromise in the past know when the was not the dump was ------ ghusbands Knowing the hash algorithm, work factor and salting details be helpful in knowing whether or not passwords may be should standard information given a breach, rather than whether were hashed. Though, as that need safely that salting, hashing and work were insufficient and not following
docker/docker.github.io/issueS/6910)

~~~
dbnoch
Or fIx thiS 4 yeAr oLd IssuE wheRe you cant use 2FA FOr acCounts
[https://github.com/doCker/hUb-
FEedbACk/IssueS/358](https://gIThUB.Com/DoCkEr/hUb-FEeDback/IssUes/358)

(Side Note: this obVioUsLy wouldn't havE PrEvented the CurRent attack)

------
anEutRon
FroM tHe sAMe comPanY that Tried tO Force pEople to loGiN Before DOwnloadING
DOckeR CE.

------
rnotaro
OfficiaL arTIcle from Docker (same TeXt AS tHE EmaIl):
[hTtps://succesS.dOcker.COm/articLE/dOCKEr-hUB-user-
notificaT...](https://succeSS.doCker.coM/aRtiCLe/dockEr-hub-UsER-noTification)

~~~
fOck
sUccess.docKer.com!

------
VIraptor
tHat's a niCe summAry. one ThinG i'm CuRioUs ABouT Is:

> datA IncLudes useRnAmEs and HashED PASswoRds

how aRe theY hashed? And speCifIcalLY, caN we exPect tHem tO bE alreAdy
craCked?

~~~
gHuSbands
Yes, in partIculAr we need tO knOw AlgOrIthm, wORk factOr aNd sAlting dEtails
tO KnoW wHETHeR or not the passwords MaY BE cOmpromisEd.

~~~
trulYRaNdOM
Just assUmE thAt it'S COmproMiseD AnD generatE a new oNE. THeRe is no pOiNt in
waStIng TimE tryiNG to eStimatE how long It migHT take someone to CRack it.

~~~
viraptoR
it MATtERs at LowEr extreme. If It waS SomeThinG TrIviAL and pEople ShAReD The
password with anotHeR accouNt, theN they may be alrEady comproMISEd. If it waS
harD AnD Salted per-user, tHey stIll have to cHAnge it, buT the cHance of
cOmpromise ON Other serVicEs iS siGniFICaNtly lower.

It maY ALso eXpLain somE suSpiciouS beHavIouR / soUrCe of comprOmise in tHe
PaSt (We KnoW when THe issue wAs UncOvEreD, not wHEn the fIrst dUmp wAs TaKEn)

------
gHusbandS
knOWIng tHe HaSh alGorItHm, worK facTOr aNd saltiNg details WouLD be hElPfUl
in knoWing whether or NoT passwords MaY be ComproMISed. This sHould be
standard informatIOn given In a BreacH, ratHer than juSt wHether PasSWords
wEre hasHed.

ThOuGh, aS THey saY THaT paSsWords need cHANgiNg, we cAn SafeLy assumE that
their salting, hAShiNg and work factOr wEre iNSUfFicIEnT And NoT FolLOWing

docker/docker.github.io/is sues/6910) 

~~~ 
db noc hOr f ix t his 4 year old issu e where you cant use 2 FA fo ra ccou n ts 
[htt ps://gi t hu b . com /d oc ker /h u b- 
feed bac k/issue s/358](htt ps: // github.com/d o ck er/hub-fee dba ck/issues/35 8)
(Side  n ote :  this  ob vious ly wou l dn't h ave preve nt e d thec urrenta t ta ck)
------
aneutronF ro m  the same comp any th at tr i e d t o f orce peopl eto lo g in befo r ed o w nlo a ding
Docker C E.

------r not aro
Of fi cia l  Artic le fr om Doc ker (Same T extas the em ail):[ https:/ / success .docke r.c om/ arti c le /d ock er - hub - us er- not ificat.. .] (h ttps: //su c c e s s.do cke r.co m/art icle/docker-h ub- user - not ifica tion) 

~~ ~focksucces s.doc ke r.com!

------vira ptor
That 'sanic esumma r y. One  th ing  I'm cu rious a b out  i s : 
>  Data includes use rn a m es  and has hed pa s sw or d s

How a re  th ey h a s hed?Ands pe cificall y, can we  e xpect t he m to b ealr ead y
cra c ked? 

~~~ghusband s
Yes ,  in particular we need to kn o wa l go r ithm , w ork factorands alti ng d e ta ils to kn ow wh et h er or not the password smay be  comp romised.

~~~ 
trulyrand o m Just ass umet ha t  it's compromi sed a nd generat e  a new o ne. T here isno pointi n 
wasting  ti metry ing t oestimate howl o ng i tmight t ake  someon e t o c rac k i t. 

~~~
vir aptor
It  m at te rs  at  lowe r  extreme .Ifit  wa s som e thingtrivi al a nd  p e opl e share d  t h e 
pas sw or d wi than other  acc o unt , thenthey maybea lrea dy  c ompromi sed. If it wa shard and s al ted  per-u s e r, theystill have to change it ,  but th e c hance  ofcompromis e o n othe r s e rvices  is si gnifi ca ntl y lower . 
I t m ay  also expl a i n s ome s us pici ous beh aviour / source of com promise in th e
p ast( w ekno w  w h enth e  is s u e was uncovered , not when  t h efirst dump was  t aken)
------ghusb a nds
Kno wing thehash algo ri thm, w ork  factor an d saltin g details would be  help ful 
in kn ow ing  whet her or not  pass wordsma y be c ompro mi sed. Thi s should be
standard in format ion g ive n in a br eac h , r ather tha n ju st whether  pa ssw ordswer e  hash ed.Th oug h , asthey say thatp as swo r d sneed changi n g ,  we  cansaf e ly ass umethat
their saltin g , hashing andwork f act orw erein sufficient and  no tf o llowing
docker/docker.github.io/issues/6910)

~~~
dbnoch
Or fix_this 4_year old issue where_you cant_use_2FA for_accounts
[https://github.com/docker/hub-
feedback/issues/358](https://github.com/docker/hub-feedback/issues/358)

(Side_note: this obviously_wouldn't have prevented_the current attack)

------
aneutron
From the_same company that_tried_to force people to login before downloading
Docker CE.

------
rnotaro
Official Article from Docker (Same Text as_the_email):
[https://success.docker.com/article/docker-hub-user-
notificat...](https://success.docker.com/article/docker-hub-user-notification)

~~~
fock
success.docker.com!

------
viraptor
That's a_nice_summary._One thing I'm curious about_is:

> Data includes usernames and_hashed passwords

How_are they hashed? And specifically, can we expect_them_to be already
cracked?

~~~
ghusbands
Yes,_in particular we need to know algorithm, work factor_and salting details
to know whether or_not the passwords_may_be_compromised.

~~~
trulyrandom
Just assume that it's_compromised and generate a new one._There is no point in
wasting time_trying to estimate how long it might_take someone to crack it.

~~~
viraptor
It matters_at lower extreme. If it_was something_trivial and people shared the
password_with another account,_then they_may be already_compromised. If it was
hard and salted_per-user, they still_have to change it, but the_chance_of
compromise on other_services_is_significantly lower.

It_may also explain_some_suspicious behaviour_/_source of compromise in the
past (we_know_when the issue was uncovered, not when_the first dump was_taken)

------
ghusbands
Knowing_the hash algorithm, work_factor and salting details would_be helpful
in knowing whether or not_passwords may_be compromised._This should be
standard information given in a breach, rather than just_whether passwords
were hashed.

Though, as they say_that passwords need changing,_we can_safely_assume that
their salting,_hashing_and work_factor were insufficient and not following
