Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker, Hack Thyself

blog.codinghorror.com

Post reply on HN
Print view View original

51–60 of 114 posts

Re: Hacker, Hack Thyself

#51

Post by raesene9 »

peterclary wrote: post #18

Encrypting the hashes in the database would make it safer. That way the password hashes can't be attacked in this way unless they can decrypt them first.

Encrypting passwords wouldn't add a lot here unless you're using some mechanism to protect the encryption/decryption key (like using a Hardware Security Module), as an attacker who compromises the database is likely to compromise the key at the same time.

If you do have a hardware security module, then why not just do away with hashing altogether, encrypt the passwords with AES-128 and you'll likely be fine (as long as the attacker can't extract the key from the HSM)

Re: Hacker, Hack Thyself

#52

Post by raesene9 »

dzdt wrote: post #16

What this shows is that even with best practices passwords are a fairly weak security control. We need a standardised second factor id. The FCC or corresponding body elsewhere should mandate that phone networks and phones support a secure messenging protocol which could guarantee that a message could be sent to a phone number and only be received by that device. Password-only authentication is like locks on luggage,…

I'm not sure why you think this article shows that with best practice passwords, it's a relatively weak control?

From the article a user choosing a random (i.e. not in wordlists) 8 character password with upper/lower/numeric characters could expect an attacker to take 3 years to crack the password (and that's attacking one hash!)

Now to be clear, I totally think that passwords are a bad idea (mainly because humans aren't well equipped to choose and manage large numbers of random strings) but I don't really see why this article advances that concept?

Re: Hacker, Hack Thyself

#53

Post by eriknstr »

orng wrote: post #17

Is my math failing me or wouldn't 8 digits result in 10^8 possibilities rather than 8^10?

You are correct that there are 10^8 possibilities for a string of 8 digits.

10 possibilities in position 1

10 possibilities in position 2

...

10 possibilities in position 8

10 * 10 * 10 * 10 * 10 * 10 * 10 * 10

Alternatively one can even simply observe that 99999999 is the highest number possible and since 00000000 is possible also then we have 99999999 + 1 different possibilities = 100000000 = 10^8

Re: Hacker, Hack Thyself

#54

Post by tarr11 »

Has anyone ever done an analysis of what impact these kinds of breaches (like OneLogin for example) have on either end users or the company?

Ie, we often describe breaches as "really bad" but it would be good to quantify in terms of things like:

- Revenue Lost (Company)

- Reputation Lost (Company)

- Time Lost (Company + User)

- Increased Costs and Penalties (Company)

- Assets lost (Company + User)

Re: Hacker, Hack Thyself

#56

Post by whoami_nr »

raesene9 wrote: post #50
whoami_nr wrote: post #46

I am not an expert on password hashing but I was wondering why can't the websites hash their passwords twice using two different hash algorithms. That way when the hashes are exposed, the attackers have to go through two algorithms. Is the time complexity increase only marginal that people don't do this ?

Instead of the added complexity of implementing multiple hash algorithms, if you're using something like bcrypt or PBKDF2 you can just increase the work-factor which makes the attacker (or indeed your application) do more work to calculate the hash. There's a risk, depending on your usecase and traffic levels that if you crank work factors too high, you can impact the users perception of your performance (e.g. a logi…

Which is actually better in terms of time required to brute force(as in which takes longer) ? Two different fast algorithms with moderate work factors or one algorithm with a pretty high work factor ?

Re: Hacker, Hack Thyself

#57

Post by raesene9 »

whoami_nr wrote: post #56
raesene9 wrote: post #50

Earlier quoted context omitted.

Instead of the added complexity of implementing multiple hash algorithms, if you're using something like bcrypt or PBKDF2 you can just increase the work-factor which makes the attacker (or indeed your application) do more work to calculate the hash. There's a risk, depending on your usecase and traffic levels that if you crank work factors too high, you can impact the users perception of your performance (e.g. a logi…

Which is actually better in terms of time required to brute force(as in which takes longer) ? Two different fast algorithms with moderate work factors or one algorithm with a pretty high work factor ?

well AFAIK you can keep cranking the work factor as high as you like, so realistically one algorithm with a high work factor is likely to be better as it's a simpler thing to implement and has no drawbacks in terms of security.

Re: Hacker, Hack Thyself

#59

Post by JoshTriplett »

Diederich wrote: post #34
g_sch wrote: post #7

I saw a very interesting talk last year from someone who, as part of a company's security team, had set up a system that continually attacked the hashes of every employee's Active Directory passwords. If one was cracked, the employee would receive an automated email with a note containing the last few characters of their password and a suggestion to change it. I recall they also spoke on some security aspects of the…

Story time...please excuse the tangent, related to the above comment. In the mid 1990s, I was the computer security officer for the 81st Medical Group in the USAF, which is the proper name for a rather large DOD hospital in southern Mississippi. Though it was 22 years ago, the hospital was almost completely paperless. Every member of the staff, from doctors to orderlies, used one of the 10,000 or so VT320 terminals s…

This isn't a tangent, this is the kind of incredible on-topic story that's the highlights of an HN comments section.

Have you considered writing this up as a full post somewhere?

Re: Hacker, Hack Thyself

#60

Post by dzdt »

raesene9 wrote: post #52
dzdt wrote: post #16

What this shows is that even with best practices passwords are a fairly weak security control. We need a standardised second factor id. The FCC or corresponding body elsewhere should mandate that phone networks and phones support a secure messenging protocol which could guarantee that a message could be sent to a phone number and only be received by that device. Password-only authentication is like locks on luggage,…

I'm not sure why you think this article shows that with best practice passwords, it's a relatively weak control? From the article a user choosing a random (i.e. not in wordlists) 8 character password with upper/lower/numeric characters could expect an attacker to take 3 years to crack the password (and that's attacking one hash!) Now to be clear, I totally think that passwords are a bad idea (mainly because humans ar…

Quoth the article:

A very motivated attacker, or one with a sophisticated set of wordlists and masks, could eventually recover 39 × 16 = 624 passwords, or about five percent of the total users. That's reasonable, but higher than I would like.

Post reply on HN