Blade: a Java Web Framework

Post by mikkom » Tue, Dec 22, 2015, 9:54 AM UTC

superuser2 wrote: post #19

mikkom wrote: post #16

Earlier quoted context omitted.

If someone has local access then it's easy to crack any passwords (of any hashing algo). However if the cracker has local access and/or full access to DB then weak password hashing is one of the least problems.. Making password checking slower is very easy if the cracker doesn't have local access. Just sleep for XXX ms at every hash check and double it for every incorrect attempt (per IP).

Password hashes are stolen in a variety of ways, when attackers find a way to dump arbitrary files or get results of arbitrary SQL strings, even one byte at a time. Yes, if that happens the site is toast, but 99% of its users have used that password somewhere (everywhere) else. That's not your fault, but using a better hashing algorithm is so trivial that it makes you an asshole to betray your users like that.

Post by mikkom » Tue, Dec 22, 2015, 9:59 AM UTC

onion2k wrote: post #20

mikkom wrote: post #12

Earlier quoted context omitted.

As I'm not up to the current security research, what is problem with using md5 hash of name+password? Is the missing salt problem you are refering to? Brute forcing md5 is easier than some other hashing algo because of collisions? (And I would disagree that knowing that how to properly hash passwords means that the whole framework itself is poorly designed)

Speed is the problem. ocl-hashcat can test in the region of 6 billion MD5 hashes a second on a decent GPU. With a random salt and, say, an 8 character password it'd take a long time, but not so long it's impossible. On a site that includes rules like 'Must have an uppercase letter', 'Must include a number', and 'Must include a special character' you actually reduce the size of the space and consequently make the pass…

Post by onion2k » Tue, Dec 22, 2015, 10:13 AM UTC

mikkom wrote: post #23

onion2k wrote: post #20

Earlier quoted context omitted.

Speed is the problem. ocl-hashcat can test in the region of 6 billion MD5 hashes a second on a decent GPU. With a random salt and, say, an 8 character password it'd take a long time, but not so long it's impossible. On a site that includes rules like 'Must have an uppercase letter', 'Must include a number', and 'Must include a special character' you actually reduce the size of the space and consequently make the pass…

Okay I understand this much better now. I was assuming this was about remote access exploit not a local one. Point taken. Use SHA-? instead of MD5.

Post by alimbada » Tue, Dec 22, 2015, 10:22 AM UTC

Post by sah2ed » Tue, Dec 22, 2015, 11:15 AM UTC

dodyg wrote: post #4

hmmm... public User signin(String username, String password) { String pwd = EncrypKit.md5(username + password); return model.select().eq("username", username) .eq("password", pwd).fetchOne(); }