31–40 of 45 posts
Whats stopping someone from creating a list of what strings trslate to each hash
https://en.wikipedia.org/wiki/Salt_(cryptography)
While that was true before GPUs
>To a modern attack, salts quite simply don’t help.
Everybody should really move to key derivation functions (ideally scrypt)
Here comes the damage control https://twitter.com/TMobileHelp/status/982334382806454272 Hoping this blows up. Time to short.
I'm wondering. Why would encrypting the password be any more worse than hashing ? If the private key of encryption is well kept, I don't see why they couldn't do that. I understand though that no one being able to know the password except the user is utmost security, but why not encrypting it ?
So, you never worked for us in Austria though. But thank you very much for sharing your opinion.
Thanks for stating that you seemingly haven’t understood what we’re trying to tell you.
Oh, I do get it. I hope you enjoyed my response"Well, what if your infrastructure gets breached and everyone’s password is published in plaintext to the whole wide world?" "What if this doesn't happen because our security is amazingly good? ^Käthe" This is begging for it.
Whats stopping someone from creating a list of what strings trslate to each hash
https://en.wikipedia.org/wiki/Salt_(cryptography)
The problem with telecom companies is they have customers from a wide spectrum of technical capabilities. Their systems need to be able to support the baby boomer who calls support because they can’t remember their password, pin, or something...
I’m not defending these practices by any means, but these society-spanning institutions are facing challenges of balancing usability and security that many companies do not need to worry about.
If a company wants to implement a system like this, fine. But please tell me before I enter my password so I know not to reuse another password of mine.
"Well, what if your infrastructure gets breached and everyone’s password is published in plaintext to the whole wide world?" "What if this doesn't happen because our security is amazingly good? ^Käthe" This is begging for it.
"challenge accepted"
[1] https://twitter.com/fabricio_giglio/status/98236273592413798...
Earlier quoted context omitted.
https://en.wikipedia.org/wiki/Salt_(cryptography)
https://github.com/crypto101/book/blob/master/Crypto101.org#... While that was true before GPUs >To a modern attack, salts quite simply don’t help. Everybody should really move to key derivation functions (ideally scrypt)
Is N=14, r=8, p=1 good enough?
This is a really common technique in the UK, especially with online banking. “Enter the 1st, 4th, and 7th characters of your password.” Apparently the point is to prevent replay attacks. The problem with telecom companies is they have customers from a wide spectrum of technical capabilities. Their systems need to be able to support the baby boomer who calls support because they can’t remember their password, pin, or…
At what point do we just have to leave these people behind?
This is a really common technique in the UK, especially with online banking. “Enter the 1st, 4th, and 7th characters of your password.” Apparently the point is to prevent replay attacks. The problem with telecom companies is they have customers from a wide spectrum of technical capabilities. Their systems need to be able to support the baby boomer who calls support because they can’t remember their password, pin, or…
Is it okay to sacrifice security because some members of society are either too old/dumb/misguided/whatever to bother? At what point do we just have to leave these people behind?