@Simon sorry i forgot you are canadian let me break it down for you :P 1, i am implying you are an ugly whale 2, to get se swag you cannot be an ugly sea animal... 3, that means I am in turn saying you are suggesting they have a different reason for throwing you back in the ocean
I'm not sure how that reasoning stands up. I mean:
1.) How do they know bot is trying username/password-same-as-username without viewing the password in the clear?
2.) If they've witnessed the activity long enough to realize what it is, why bother watching it any more instead of just killing it? (Presumably the answer here is the successful login being caught up in the logs before SEI actually realized what was happening and killed the bot.)
@Iszi I think it goes as: they don't look at passwords usually, but they can if they suspect ongoing foul play (incoming passwords only, not stored) as part of on-the-fly analysis.
@MarkBuffalo Possible alternative, though not really clear from stated facts: They brute-forced the hashes for accounts that the bot successfully logged into.
@Iszi It depends on whether the authentication is local or delegated (OpenID...) but in the former case, the password pops up unscathed in the RAM of their servers, so of course they can look at it if they really want.
@Iszi trying to avoid describing the exact scenario here, but imagine you were trying to protect access to a house and left a key with the neighbor. Then the neighbor puts the key under the mat. No one needs to pick your lock; they just need to look under every mat and try all surrounding doors with what they find there.
@Shog9 It might be argued that trying a key on doors is already illegal when that's not your door and your key, but that's probably where the analogy breaks down, as analogies always do.
@Shog9 You have to take into account that people interested in security are, by definition, very nosy. You must feed them with information; you cannot expect them to leave unresolved issues alone.
@MarkBuffalo well, it is. I mean, you're still leaving your key with the neighbor, if nothing else there's an information leak even if you can't use that information directly. So immediately after patching this up, we got the person responsible trying to social-engineer his way in.
@DavidFreitag It was stated that a top Sec.SE user was discovered to have weak credentials, sufficiently weak that only knowing the account name would also grant access to the user's e-mail.
@DavidFreitag It's still unclear how SEI staff were able to derive this information - particularly that a user's account name was used to derive the password, or that the derived password granted e-mail account access - without actually having access to the passwords as cleartext (or encrypted data, to which SEI has the key) either from the database or during monitored login attempts.
@MarkBuffalo With all of the relevant details of what the bot was doing and how it was doing it, SE would be able to make an assessment of the issues at hand
@DavidFreitag Certainly. But that should say nothing of what the password content was. Just that the bot had sufficient information to guess the right one somehow. And unless you're running the bot, or you have the means necessary to see the cleartext form of the password attempted, then you have know way of being sure what the bot does or does not know.
@Iszi You're barking up the wrong tree. Sans analogies: This vulnerabilities resulted from users making choices that had obviously poor security properties . Finding vulnerable users did not require SEI to know passwords, or any sensitive user data that they would not normal have access to in the normal course of business.
Anyway, point is the system is far from perfect but we do take it seriously and if you identify a problem please bring it up on meta or send us a private email instead of whining about it in a chat room. Stuff doesn't tend to get fixed unless it gets reported.
there are lots of users who qualify, BTW. And most probably made a conscious decision to weaken security (a good number publicly gave away passwords on LogMeIn before we go them to shut down SE pages). I just thought it was amusing to see a high-ranking Sec.SE user in the list with a bunch of mostly-disposable accounts.
@DavidFreitag If that's how the account was made than it would seem to be even less clear how SEI knows anything as they should have even less visibility to the details of the login attempt.
@Iszi One might infer that there was a bot that tried logging in on all accounts (with, say, Google-based credentials), and succeeded on one of them. From that, @Shog9 may infer that the credentials were very weak because a completely automated bot guessed them in a few tries.
If a chimpanzee banging on a keyboard succeeds in getting into your account, then I don't need the chimpanzee to tell me the password to guess that it was the kind of password that can be guessed by a chimpanzee.
@ThomasPornin Yes and no. All that SEI should know from watching said bot is whether or not it was able to get into an account, and what login method was used. What they cannot know, without having inappropriate access to certain details, is what information the bot used to generate candidate passwords. And without that detail, one cannot assert that "you can get full access to their email by knowing their account name" alone.
@Iszi If the bot goes through all accounts in a fixed order, then it can be inferred that whatever the bot tries does not come from specific knowledge of these accounts, save for what is publicly known of them (i.e. the account name).
