German officials confirm 18 million emails and passwords stolen | Hacker News Reader

German officials confirm 18 million emails and passwords stolen

dw.de

42 pointsicholboy16 comments

You non-Germans don't know how mind-boggeling insane this whole story is. There is a governmental agency, the BSI, whose job is to be on top of everything regarding security in information systems.

They tell us that millions of email accounts are compromised.

What they don't tell us is _which_ accounts are compromised or even what service provider these accounts are with. Maybe the key information here is that the info was leaked in a database hack at a big consumer software company.

Who knows?

Nobody! That's who. Because they refuse to give any details that would actually be useful to end-users. Now _everybody_ who has an email account is scared that their account is compromised.

Do you know what the punchline here is?

They said they would give more details, but not before Monday. It might not be obvious to non-Germans, but this little detail reeks of a kind of bureaucratic weirdness that is as German as Beer: I bet they will only release more info on Monday because the person in charge doesen't come into the office before Monday.

Sorry if this was a bit ranty, but the whole thing is just so stupid.

The article says the info was released on Thursday, so there's still Friday in between. Maybe someone at that big consumer software company wanted some time to prepare a defense? Maybe law enforcement wants to procure movement in some hacker groups they are tracking, by keeping them from knowing whether they've been busted? Maybe the BSI really doesn't know where the addresses are coming from? There are so many options here.

What are you complaining about? There was a leak some months ago and the BSI kept the information about the leak secret until they had set up a system to inform people. Lots of people complained that they didn't publish the information earlier. Now they are doing, what I think is the correct way. Now they have time to discuss how to tell the people whose data has leaked which they surely will do.

Too bad cybercriminals aren't awaiting the orderly notification of people before they use the information to do harm. The leak certainly isn't secret to the perpetrators.

I concur. Another result of informing the public in this manner is that reporting on the leak is murky and alarmist.

Yesterday I watched the Tagesschau, a highly-regarded public TV news program, and their report on this story was so short on information that all it could do -- whether consciously or not -- was to vaguely convey how dangerous cyberspace is. They even had the visuals of numbers flying through space for lack of actual informative content. In a country that's already often backwards when it comes to digital communication technologies, this kind of reporting is completely unhelpful.

wait, no shot of a blinking switch port led?

I saw a news show on ZDF yesterday and they actually recommended using an email provider that has 2 factor auth with "some code on you mobile". I guess no non-geek understood it but I was still shocked. Usually they just say you should have different passwords for different sites.

Germany is quite good it seems. I don't really understand where it comes from, but the last time I randomly turned on the TV in Berlin, there was an educational program about PGP. At around 20:30, on a standard TV channel, one of the first ones on the list at the hotel, so it wasn't something obscure either. It seemed to describe the whole idea of asymmetric encryption too (inferred from the animated presentation).

I was really impressed.

Well, the part of the population that cares about information security is very well informed

But the rest seems to live in a luddite world. If you had watched TV more you would have seen that there are a lot of ads for: web games, PayPal and other websites trying to drag the average consumer into, you know, using the stuff.

Paying with a Debit Card is rare in Berlin, Credit Cards are barely non-existent (but they have some other ways of paying stuff online and on stores)

Security of bank accounts is usually done through a list of one-use code numbers (still, they - and several other countries - have payee initiated money transfers between accounts/banks, something that is rare in US/Canada)

You must have caught a lucky moment. Because of the current incident (passwords stored in plaintext were stolen!), spiegel online[0] wrote an article telling their readers they'd be better off if they had chosen stronger passwords.

> 18 Millionen gestohlene Passwörter und Logins hat die Staatsanwaltschaft Verden entdeckt. Mit ein paar Tricks kann man sich zumindest vor dem Schlimmsten schützen, wenn Datendiebe und Hacker zuschlagen.

translates to:

> 18 million stolen passwords and logins were found by the Staatsanwaltschaft (prosecution) of Verden. With a few tricks [i.e. a strong password] you can protect yourself from the worst when data thiefs and hackers attack.

[0] http://www.spiegel.de/netzwelt/web/passwort-emails-und-login...

I wonder why internet companies don’t have contingency plans in place for data theft. I would be glad to be able to check whether my account is affected and to receive an email with instructions immediately. Instead it’s always a big surprise and it takes weeks until details are published…

I wonder why internet companies don't just do the right thing and use good hashes (or better methods like SRP, but that requires client updates) so that none of this would even mater

Because they don't start out with well-designed systems (that costs money), and they don't want to upgrade their systems to be good (that costs money).

It's very simple, but it's only obvious after you've seen it happen too many times.

is there an alternative source for this story like from Spiegel or something other than dw.de?

For what it's worth, DW is Germany's "International public broadcaster" so it is a reputable news source.

If you want it on SPON ("blood, tits and murica"), here you go: http://www.spiegel.de/netzwelt/netzpolitik/e-mail-passwoerte...

Sorry, I meant to submit the new data theft in Germany which happens only 3 months after the one posted:

http://www.dw.de/german-officials-confirm-18-million-emails-...

Reply on news.ycombinator.com