291–300 of 596 posts
Earlier quoted context omitted.
But would it require users to change their password? The way I would have implemented it, but would be keen to know how secure it is, is that you start with the md5 of the password ( md5(password) ). You then bcrypt or scrypt that md5 ( bcrypt(md5(password)) ) and replace the md5 in your database with the bcrypt hash. When a user logs in, all you need to do is to calculate the md5 first then check that md5 against th…
The problem is in collisions. Md5(password) can yield the same result for many different values of password so simply bcrypting that result means that you start with a restricted possibility space. So less secure. Punts the question to how much less secure. Seems to me it would still be worth it to do and then all new passwords going forward are done correctly.
Not "many different" using the normal constraints of text/numbers/typographical-marks and with maximum password lengths of 32 or so (I'll bet Yahoo's was shorter than that in 2013).
Are there any MD5 collisions in [:graph:]{,32} ?
Earlier quoted context omitted.
Yes, 'offshore' is a race. Every critique is a racism. Coming from said 'offshore' (at least in regards to the US), I see that 'quality' people work remotely for monies comparable to the onsite workers, launch startups, et cetera. If you outsource to the offshore for the costs, guess what, you get lesser quality for the said cost. Nothing racist in that, but I understand your position - a SJW to every household!
I'm sure they meant to say xenophobic.
Earlier quoted context omitted.
Yahoo has been a company for a long time. I imagine your conversation happened round about 1999 when using MD5 wasn't insane. And then they were just slow to upgrade. It's still bad, I'm just saying the conversation about what hash algo to use didn't happen yesterday.
I'd like to believe that. However, I was recently asked to test a new website for an organization I volunteer for, and discovered their "forgot password" flow emailed me my plaintext password. I wrote an explanation of why this was bad, and how it could be fixed, to a non-technical friend of mine who works there; he passed my email to the (Bay Area based!) consulting shop that did their website. The shop sent this re…
That's insane...
Earlier quoted context omitted.
There are likely to be a lot of identity systems using the password in the database, all of which have been coded to look for an MD5 hash, not a salted hash. This means code in a number of applications have to be updated at the same time. The typical way around this is to create your new destination column (e.g. sha256 with salt), and progressively have applications reference this column rather than the MD5 unsalted…
> It's a huge amount of work, and if the applications were made in 1990's, the code is likely legacy. Which begs the question, can legacy code survive in an international network?
A large organisation will implement layered security (otherwise known as layers of the onion) to prevent this type of attack. This means; more secure passwords to access the password database, fewer people with access, rotation of access passwords, auditing of backup storage and encryption, etc etc. Clearly Yahoo's layers of security were all broken to allow this type of theft.
Earlier quoted context omitted.
It's one way to do it, which is okay sometimes. The other way is to add a new empty column for bcrypt. The next time the user logs in, you save the bcrypt hash and you remove the MD5 hash. Over time, the active users will be migrated to the new scheme. The only issue is the abandoned accounts, they'll keep the old weak scheme.
I am not sure I agree. Your way will leave all the non active users exposed in the case of a leak. They may not be active on your website but are likely active on another website using the same password.
For a website like Yahoo with billions of abandoned accounts, that's a serious drawback ^^
Earlier quoted context omitted.
Knock-Knock... I pay for Y!Mail Plus. It's not just free users wanting a drop-box for spam.
I actually wasn't aware there was also a paid service. Though I doubt this is a large share of the 1B accounts.
Earlier quoted context omitted.
... "offshore workers" are not a race. You realize offshore workers could be the same race as the person posting right?
This is technically true, which is the best kind of true. Swap in nationalist, chauvinist. It's utterly clear what was meant by racism above, in spite of your semantics.