Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker, Hack Thyself

blog.codinghorror.com

Post reply on HN
Print view View original

91–100 of 114 posts

Re: Hacker, Hack Thyself

#91

Post by Diederich »

JoshTriplett wrote: post #59
Diederich wrote: post #34

Earlier quoted context omitted.

Story time...please excuse the tangent, related to the above comment. In the mid 1990s, I was the computer security officer for the 81st Medical Group in the USAF, which is the proper name for a rather large DOD hospital in southern Mississippi. Though it was 22 years ago, the hospital was almost completely paperless. Every member of the staff, from doctors to orderlies, used one of the 10,000 or so VT320 terminals s…

This isn't a tangent, this is the kind of incredible on-topic story that's the highlights of an HN comments section. Have you considered writing this up as a full post somewhere?

I had not considered that, but I will now, thank you. (:

Where do you think should I post it?

Re: Hacker, Hack Thyself

#92

Post by emn13 »

dsp1234 wrote: post #69
whoami_nr wrote: post #46

I am not an expert on password hashing but I was wondering why can't the websites hash their passwords twice using two different hash algorithms. That way when the hashes are exposed, the attackers have to go through two algorithms. Is the time complexity increase only marginal that people don't do this ?

https://link.springer.com/chapter/10.1007%2F978-3-540-28628-... https://link.springer.com/content/pdf/10.1007%2F978-3-540-28... Abstract: "In this paper, we study the existence of multicollisions in iterated hash functions. We show that finding multicollisions, i.e. r-tuples of messages that all hash to the same value, is not much harder than finding ordinary collisions, i.e. pairs of messages, even for extremely lar…

In that paper they're concatenating two hash outputs which obviously (right?) only makes it easier to reverse the hash - the attacker need only pick whichever hash he can work with quicker, and find the preimage for that. Given the fact that password entropy is much lower than hash entropy, the preimage thus found is almost certainly the original password, not a collision - rendering solving the other hash preimage moot.

If you want to force the attack to go through two hashes, you'd use functions sequentially (e.g. F(G(input)), not F(input)+G(input)), which the paper at least initially doesn't talk about. I didn't read the whole thing, mind you...

Note that password-stretchers like bcrypt/PBkdf2 use only fairly small extensions to this idea, so clearly in general the construction isn't known to be flawed.

Re: Hacker, Hack Thyself

#93

Post by JoshTriplett »

Diederich wrote: post #91
JoshTriplett wrote: post #59

Earlier quoted context omitted.

This isn't a tangent, this is the kind of incredible on-topic story that's the highlights of an HN comments section. Have you considered writing this up as a full post somewhere?

I had not considered that, but I will now, thank you. (: Where do you think should I post it?

A blog, and submit the post here? Or, failing that, a series of 20ish tweets?

Based on the background you described, I'm sure that's not the only story you have.

It'd also make a great lightning talk for a conference.

Re: Hacker, Hack Thyself

#94

Post by codinghorror »

JoshTriplett wrote: post #93
Diederich wrote: post #91

Earlier quoted context omitted.

I had not considered that, but I will now, thank you. (: Where do you think should I post it?

A blog, and submit the post here? Or, failing that, a series of 20ish tweets? Based on the background you described, I'm sure that's not the only story you have. It'd also make a great lightning talk for a conference.

oh gosh please no series of 20 tweets :(

Re: Hacker, Hack Thyself

#95

Post by codinghorror »

raesene9 wrote: post #75
dzdt wrote: post #60

Earlier quoted context omitted.

Quoth the article: A very motivated attacker, or one with a sophisticated set of wordlists and masks, could eventually recover 39 × 16 = 624 passwords, or about five percent of the total users. That's reasonable, but higher than I would like.

Sure so the attacker has entirely compromised the site in the first place, offline brute-force only works where the attacker has already got a copy of the database. They've then eventually got access to 5% of the user's passwords, and the one's they got access to were all based on dictionary words... Assuming that the site has any level of reactive/detective controls, they've noticed the breach and invalidated the pa…

well yes, that's true, you don't need to outrun the bear, you just need to outrun the person in front of you ;)

Easy targets will always been compromised first.

Re: Hacker, Hack Thyself

#96

Post by glitcher »

kqr wrote: post #21
mike-cardwell wrote: post #10

Earlier quoted context omitted.

I used to work at a University in the UK. One of my responsibilities was the email system. We constantly suffered targeted phishing attacks where the sender pretended to be from the IT department and required the recipient to respond with their password, for various made up reasons. Our spam filters captured most of these on the way in, but some still got through. And people replied. People replied all the time. Stud…

Interesting! Did you consider regularly sending phishing emails yourself, and automatically call out anyone who reply anything at all to them? I mean, you won't catch quite as many people, but eventually most will learn, one would think.

> but eventually most will learn, one would think

With a large batch of new incoming students every year this problem would never go away.

Re: Hacker, Hack Thyself

#97

Post by Diederich »

JoshTriplett wrote: post #93
Diederich wrote: post #91

Earlier quoted context omitted.

I had not considered that, but I will now, thank you. (: Where do you think should I post it?

A blog, and submit the post here? Or, failing that, a series of 20ish tweets? Based on the background you described, I'm sure that's not the only story you have. It'd also make a great lightning talk for a conference.

Last time I submitted something I thought was really interesting here (https://news.ycombinator.com/item?id=12652035) I don't recall it getting anywhere. But maybe the 10th anniversary of Hacker News really wasn't that interesting. (:

Re: Hacker, Hack Thyself

#98

Post by Diederich »

codinghorror wrote: post #94
JoshTriplett wrote: post #93

Earlier quoted context omitted.

A blog, and submit the post here? Or, failing that, a series of 20ish tweets? Based on the background you described, I'm sure that's not the only story you have. It'd also make a great lightning talk for a conference.

oh gosh please no series of 20 tweets :(

So say we all.

Re: Hacker, Hack Thyself

#99

Post by bfstein »

tbabb wrote: post #61

IANA security researcher, but isn't it a bad idea to publicly post a list of known-good passwords associated with accounts on your own site? I raised an eyebrow at the hash/salt table alone.

My guess is they forced password resets on those users whose passwords were compromised.

Re: Hacker, Hack Thyself

#100

Post by Bakary »

dublinben wrote: post #24
peterwwillis wrote: post #12

I'm comfortable using passwords But those are bad comparisons. A key and lock is an asynchronous single use authentication+authorization mechanism. Passwords are just the authentication part, so trying to replace these just requires we have a secure way to authenticate ourselves. We have the benefit that we are using digital systems, so our authentication can be digital, too. We can also rely on multiple factors to i…

It's a lot easier than all of that. New two-factor authentication standards like U2F achieves most of that with just a simple, inexpensive hardware token.

U2F is cumbersome when you have to travel and change phone numbers frequently. In many cases there is no real way to have a line to one of your authentication methods, since you can never get the SMS confirmation.
Post reply on HN