Watch Your Passwords - Spotify

One of the downsides of cloud-based applications is an even greater need to watch the security of the network protocols in use. Traffic going outside the private network (and potentially traffic on it) needs to be securely encrypted between the user and servers, if it contains sensitive information. If passwords are compromised, users need to be notified, so that they can change them and assess the impact on their security.

Spotify is a relatively new on-line music service, somewhat in the vein of Last.FM. “Spotify - a world of music. Instant, simple and free” at least that’s what their website would say, if it wasn’t down as I am writing this (it was displaying a WordPress Error). However, that’s not the worst of the news for the folks at Spotify or it’s users, as you can read from “the NEXT web”: BREAKING: Spotify Hacked. If You Are a Member, Read This.

More from that email to Spotify users reads:

Last week we were alerted to a group that managed to compromise our protocols. After investigating we concluded that this group had gained access to information that could allow testing of a very large number of passwords, possibly finding the right one. The information was exposed due to a bug that we discovered and fixed on December 19th, 2008. Until last week we were unaware that anyone had had access to our protocols to exploit it.

It’s a long time since December the 19th. Spotify obviously choose not to say anything at the time. It would have seemed wise to at least get their users to change their passwords at that point, instead of sitting on the issue.

Today’s email to users goes on:

Along with passwords, registration information such as your email address, birth date, gender, postal code and billing receipt details were potentially exposed. Credit card numbers are not 
stored by us and were not at risk.

The issue apparently only affects the accounts created on or before December 19th (I believe the Spotify service was in closed Beta at that point). I say apparently, since the passwords were exposed by interactions between Spotify’s protocols and more standard password hashes, so it probably needs an independent expert eye over it, looking at the security of their protocol. More on the Spotify blog.

For me, the take away here is to be cautious of applications with proprietary protocols. The advantage of more standard protocols is that there are large developer and security communities working with them. That means they get a fair amount of testing and they aren’t dependent on security-by-obscurity.