Tell HN: Epik have finally informed customers of their data breach | Hacker News Reader

Tell HN: Epik have finally informed customers of their data breach

11 pointsopheliate7 comments

Received at 19:20 UTC, approx 2 days after the breach was publicly known:

> At Epik, we take security and the privacy of your information very seriously. Therefore as a precautionary measure, I am writing to inform you of an alleged security incident involving Epik.

> Our internal team, working with external experts, have been working diligently to address the situation. We are taking proactive steps to resolve the issue. We will update you on our progress. In the meantime please let us know if you detect any unusual account activity. I am proud of our team’s efforts as we do our part to empower a thriving internet for the benefit of our customers around the world.

> You are in our prayers today. We are grateful for your support and prayer. When situations arise where individuals might not have honorable intentions, I pray for them. I believe that what the enemy intends for evil, God invariably transforms into good.

> Blessings to you all.

> Regards,

> Rob Monster

> Founder and CEO

> Epik Holdings Inc

> At Epik, we take security and the privacy of your information very seriously.

If this were true, how did they end up with an engineering culture that uses unsalted MD5 to hash passwords?

If you search for "securing passwords," hashing is the first topic covered.

At some point we have to accept that 95% of companies do not take security seriously and decide what to do next.

> At some point we have to accept that 95% of companies do not take security seriously and decide what to do next.

Perhaps we need an food hygiene rating for software? Every year or two every piece of publicly facing software which deals with sensitive data should be audited for security by approved auditors. Failure to pass such an audit would give the company 6 months to address the issue or close the system to customers until the security issue is resolved.

As part of this audit process companies could be given a "security score" which they would be required to display to their customers kind of how UK restaurants have to display their food hygiene rating to customers. Admittedly, I don't pay a huge amount of attention to a restaurant's hygiene rating, but the fact it's there at least gives me confidence that hygiene is being taken at somewhat seriously by any restaurant I visit. I don't feel the same about security on the majority of websites I visit.

The email felt very off to me. Strange wording to the situation.

Welp. I bought a domain I needed from them a few weeks ago (waiting to transfer it out); didn't have much of a choice. Are the dumps posted already?

Was a post yesterday with a link (the link itself appears to be down now, but here's the post anyway: https://news.ycombinator.com/item?id=28532464 )

If it's to be believed, yes, looks like a torrent is going around. Unsalted passwords, everything

edit: https://archive.is/S6loc mirror of announcement

Is "Rob Monster" some kind of evangelical weirdo?

This is weirdly unprofessional phrasing.

I'm also an evangelical weirdo. He is speaking the language of his people, with biblical references. I'm not sure I would do the same in this context but it is a step up from the spin and lies we often hear.

I have experienced some choice phrasing myself in business down through the years which I am too shy to repeat :-)

Reply on news.ycombinator.com