IANA security researcher, but isn't it a bad idea to publicly post a list of known-good passwords associated with accounts on your own site?
I raised an eyebrow at the hash/salt table alone.
Hacker, Hack Thyself
61–70 of 114 posts
Re: Hacker, Hack Thyself
#62I saw a very interesting talk last year from someone who, as part of a company's security team, had set up a system that continually attacked the hashes of every employee's Active Directory passwords. If one was cracked, the employee would receive an automated email with a note containing the last few characters of their password and a suggestion to change it. I recall they also spoke on some security aspects of the…
I used to work at a University in the UK. One of my responsibilities was the email system. We constantly suffered targeted phishing attacks where the sender pretended to be from the IT department and required the recipient to respond with their password, for various made up reasons. Our spam filters captured most of these on the way in, but some still got through. And people replied. People replied all the time. Stud…
What if I send an email with a partial dictionary, hidden in an invisible HTML block. If the user is blocked from replying, I know their password was in my original email.
Re: Hacker, Hack Thyself
#63Earlier quoted context omitted.
I used to work at a University in the UK. One of my responsibilities was the email system. We constantly suffered targeted phishing attacks where the sender pretended to be from the IT department and required the recipient to respond with their password, for various made up reasons. Our spam filters captured most of these on the way in, but some still got through. And people replied. People replied all the time. Stud…
What if I send an email with a partial dictionary, hidden in an invisible HTML block. If the user is blocked from replying, I know their password was in my original email.
How do you know they're blocked from replying?
Re: Hacker, Hack Thyself
#64I built my latest application using Amazon Cognito for user management. My application and database don't ever know anything about the passwords. Amazon's problem.
> Amazon's problem. Delegate to someone else ™ isn't always the answer to your security problems. It only adds more complexity, no more or no less security.
If my options were Amazon or roll my own, using Amazon would both
1) Decrease complexity, and
2) Add more security.
This is supposing I am not a security expert and that Amazon has a good implementation.
Of course, we all have libraries to use etc.
It's still a pretty good option.
Re: Hacker, Hack Thyself
#65I am not an expert on password hashing but I was wondering why can't the websites hash their passwords twice using two different hash algorithms. That way when the hashes are exposed, the attackers have to go through two algorithms. Is the time complexity increase only marginal that people don't do this ?
I think that's more security through obscurity rather than difficulty.
Once the attacker figures out what the 2 hashing algorithms are, the scenario basically becomes the same as cracking hashes of 1 algorithm of increased difficulty (through number of passes)
So, like the other answer implied, the increased complexity of maintaining 2 algorithms might not be worth the obscurity trade-off in the end.
However, I am not a security professional either, so perhaps my opinion is not comprehensive enough.
Re: Hacker, Hack Thyself
#66I saw a very interesting talk last year from someone who, as part of a company's security team, had set up a system that continually attacked the hashes of every employee's Active Directory passwords. If one was cracked, the employee would receive an automated email with a note containing the last few characters of their password and a suggestion to change it. I recall they also spoke on some security aspects of the…
> who, as part of a company's security team, had set up a system that continually attacked the hashes of every employee's Active Directory passwords. On the other hand of you are not part of the security team something like this can get you in some real trouble. Don't do it at home kids!
The most famous case I'm aware of:
Re: Hacker, Hack Thyself
#67I wonder if Jeff and his team know about Dropbox's password strength estimator: https://github.com/dropbox/zxcvbn
They do, it's referenced at https://blog.codinghorror.com/your-password-is-too-damn-shor... which linked in this post.
Re: Hacker, Hack Thyself
#68Is my math failing me or wouldn't 8 digits result in 10^8 possibilities rather than 8^10?
my bad, fixed
Re: Hacker, Hack Thyself
#69I am not an expert on password hashing but I was wondering why can't the websites hash their passwords twice using two different hash algorithms. That way when the hashes are exposed, the attackers have to go through two algorithms. Is the time complexity increase only marginal that people don't do this ?
https://link.springer.com/chapter/10.1007%2F978-3-540-28628-...
https://link.springer.com/content/pdf/10.1007%2F978-3-540-28...
Abstract:
"In this paper, we study the existence of multicollisions in iterated hash functions. We show that finding multicollisions, i.e. r-tuples of messages that all hash to the same value, is not much harder than finding ordinary collisions, i.e. pairs of messages, even for extremely large values of r. More precisely, the ratio of the complexities of the attacks is approximately equal to the logarithm of r. Then, using large multicollisions as a tool, we solve a long standing open problem and prove that concatenating the results of several iterated hash functions in order to build a larger one does not yield a secure construction. We also discuss the potential impact of our attack on several published schemes. Quite surprisingly, for subtle reasons, the schemes we study happen to be immune to our attack."
Re: Hacker, Hack Thyself
#70Suuuper nitpicky, but in the paragraph directly below Dark Helmet, Jeff calls his Graphics Card a 1080 GTX Ti. The GTX goes in front of 1080, since GTX is the general product line.
all right, fixed, sorry about that