Hacker, Hack Thyself • Hacker News Board

Re: Hacker, Hack Thyself

#101

Post by scoot » Sat, Jun 03, 2017, 2:09 AM UTC

Diederich wrote: post #34

g_sch wrote: post #7

I saw a very interesting talk last year from someone who, as part of a company's security team, had set up a system that continually attacked the hashes of every employee's Active Directory passwords. If one was cracked, the employee would receive an automated email with a note containing the last few characters of their password and a suggestion to change it. I recall they also spoke on some security aspects of the…

Story time...please excuse the tangent, related to the above comment. In the mid 1990s, I was the computer security officer for the 81st Medical Group in the USAF, which is the proper name for a rather large DOD hospital in southern Mississippi. Though it was 22 years ago, the hospital was almost completely paperless. Every member of the staff, from doctors to orderlies, used one of the 10,000 or so VT320 terminals s…

Many of those accounts were very powerful, because we were networked with the rest of the DOD's medical records. One example report I ran with a doctor's account credentials was 'List everyone in the DOD, past or present, who is or was HIV positive.'

Uh, um, wow. That's a pretty serious abuse of privilege you're admitting to, even by 1990s standards. I'd lawyer up if I were you. Shit-storm incoming...

Re: Hacker, Hack Thyself

#102

Post by concede_pluto » Sat, Jun 03, 2017, 2:46 AM UTC

whoami_nr wrote: post #82

BenjiWiebe wrote: post #81

Earlier quoted context omitted.

In my experience, it wouldn't be a reduction. I.e. most passwords are shorter than most hashes.

Technically, it does actually. Suppose we use SHA-256 as first hashing algorithm, the input space for the second is effectively reduced to the 256 bits of output from the first which is much smaller compared to the input space of the first algorithm.

38 characters of ASCII gibberish (all 95 printable characters) gives you less than 2^256 possible passwords, and pretty much nobody uses a password with more entropy than that.

Re: Hacker, Hack Thyself

#103

Post by sriku » Sat, Jun 03, 2017, 3:36 AM UTC

I don't trust myself enough to manage passwords properly for some small services I run 'cos I simply don't have the spare time to invest compared to investing in functionality.

For that reason I've been trying out a password-less login for a while now (works via email) and so far non tech folks haven't complained too.

It is pretty much as though you always used the "forgot password" mechanism to login.

Wrote about it here - http://sriku.org/blog/2017/04/29/forget-password/

Re: Hacker, Hack Thyself

#104

Post by Diederich » Sat, Jun 03, 2017, 5:28 AM UTC

scoot wrote: post #101

Diederich wrote: post #34

Earlier quoted context omitted.

Story time...please excuse the tangent, related to the above comment. In the mid 1990s, I was the computer security officer for the 81st Medical Group in the USAF, which is the proper name for a rather large DOD hospital in southern Mississippi. Though it was 22 years ago, the hospital was almost completely paperless. Every member of the staff, from doctors to orderlies, used one of the 10,000 or so VT320 terminals s…

Many of those accounts were very powerful, because we were networked with the rest of the DOD's medical records. One example report I ran with a doctor's account credentials was 'List everyone in the DOD, past or present, who is or was HIV positive.' Uh, um, wow. That's a pretty serious abuse of privilege you're admitting to, even by 1990s standards. I'd lawyer up if I were you. Shit-storm incoming...

Indeed; I ran the report, but I didn't open it. Big difference. (:

Re: Hacker, Hack Thyself

#105

Post by raesene9 » Sat, Jun 03, 2017, 11:03 AM UTC

codinghorror wrote: post #95

raesene9 wrote: post #75

Earlier quoted context omitted.

Sure so the attacker has entirely compromised the site in the first place, offline brute-force only works where the attacker has already got a copy of the database. They've then eventually got access to 5% of the user's passwords, and the one's they got access to were all based on dictionary words... Assuming that the site has any level of reactive/detective controls, they've noticed the breach and invalidated the pa…

well yes, that's true, you don't need to outrun the bear, you just need to outrun the person in front of you ;) Easy targets will always been compromised first.

strong password hashing definitely has it's place as part of overall app. security.

Where I think many/most applications would benefit from more security is in detecting/reacting to attacks.

Most apps have no controls in this line at all, and make an attackers life very easy in that they can keep trying vast numbers of attacks without being blocked by the application.

There's been some decent foundational work done on this by things like OWASP AppSensor (https://www.owasp.org/index.php/OWASP_AppSensor_Project) but I've not seen many applications actually implement the guidance...

Re: Hacker, Hack Thyself

#106

Post by psi-squared » Sat, Jun 03, 2017, 2:02 PM UTC

sriku wrote: post #103

I don't trust myself enough to manage passwords properly for some small services I run 'cos I simply don't have the spare time to invest compared to investing in functionality. For that reason I've been trying out a password-less login for a while now (works via email) and so far non tech folks haven't complained too. It is pretty much as though you always used the "forgot password" mechanism to login. Wrote about it…

That's a really neat solution, and avoids the cognitive overhead of having to remember yet another password (or the security risk of re-using passwords). I particularly like the way you tie the log-in token to a particular browser session so that it can't be hijacked!

Plus by merging all of the log-in paths (registration, 'forgot password', and normal login), you have one thing to design and secure rather than three. That seems like a huge advantage from a security perspective.

Re: Hacker, Hack Thyself

#107

Post by Ajedi32 » Sat, Jun 03, 2017, 4:53 PM UTC

jandrese wrote: post #88

SamBam wrote: post #32

Earlier quoted context omitted.

It might not catch the kinds of things that seem strong but end up on word lists. `correctbatteryhorsestaple`, and even more so `correctbatteryhorsestaple1` or `correctbatteryhorsestaple!` would probably pass a "strength" test with flying colors, but you bet it would get cracked in a moment by any script kiddie with a word list.

I remember seeing a list of cracked passwords and one of the ones they got was !QAZ2wsx#EDC4rfv%TGB6yhn. It passes every single password strength checker and dictionary word checker in the world, and still gets cracked.

zxcvbn actually correctly identifies that password as being the result of the user hitting multiple adjacent keys on a standard QWERTY keyboard. Still passes the strength check though because it doesn't identify the more complex pattern of moving top to bottom, then left to right across the keyboard, alternating shift with every column.

Re: Hacker, Hack Thyself

#108

Post by jon_richards » Sat, Jun 03, 2017, 6:47 PM UTC

concede_pluto wrote: post #102

whoami_nr wrote: post #82

Earlier quoted context omitted.

Technically, it does actually. Suppose we use SHA-256 as first hashing algorithm, the input space for the second is effectively reduced to the 256 bits of output from the first which is much smaller compared to the input space of the first algorithm.

38 characters of ASCII gibberish (all 95 printable characters) gives you less than 2^256 possible passwords, and pretty much nobody uses a password with more entropy than that.

The problem is that you aren't just dealing with "any output from the first hashing algo", since passwords are going into that algo in the first place. A hashing algo can't add entropy, but collisions can reduce it.

Re: Hacker, Hack Thyself

#109

Post by concede_pluto » Sat, Jun 03, 2017, 7:59 PM UTC

jon_richards wrote: post #108

concede_pluto wrote: post #102

Earlier quoted context omitted.

38 characters of ASCII gibberish (all 95 printable characters) gives you less than 2^256 possible passwords, and pretty much nobody uses a password with more entropy than that.

The problem is that you aren't just dealing with "any output from the first hashing algo", since passwords are going into that algo in the first place. A hashing algo can't add entropy, but collisions can reduce it.

An undetected I/O error is vastly more likely than even one accidental SHA-256 collision among billions of passwords. It's not quite literally impossible but I'd bet my car I never see it happen.

Re: Hacker, Hack Thyself

#110

Post by peterwwillis » Sun, Jun 04, 2017, 1:22 AM UTC

JoshTriplett wrote: post #23

peterwwillis wrote: post #14

Earlier quoted context omitted.

Where you use this is important, too. Accounts that can provide remote access or admin rights should be scrutinized heavily, whereas an office temp with an email address (and no access from the outside world) isn't much of a threat.

Not true. When that email address gets broken into, it'll get used to send spam, making your mail server a spam source, and making it harder for all the rest of your mail to reach people's inboxes. Not to mention producing more spam for the rest of us.

If someone has broken into your internal network, harvested or brute forced credentials, and is now sending emails externally, you have WAY bigger problems than spam.