Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Update

stackoverflow.blog

Post reply on HN
Print view View original

191–200 of 207 posts

Re: Security Update

#191

Post by rossdavidh »

rlt wrote: post #106

> We have not identified any breach of customer or user data. As usual, this is a meaningless statement. It could mean they have full packet captures they've completely audited, or it could just as easily mean "we don't keep logs of any kind so we have no fucking clue".

Well, I think it is intended, and usually interpreted, as a comment on their own state of knowledge at that point. In other words, "we're not giving you any details because we don't know yet, but we're looking into it". At least, that's how I interpreted it.

Re: Security Update

#192

Post by School-Cotton »

lucb1e wrote: post #176
lazyjones wrote: post #158

Earlier quoted context omitted.

> With the right setting, it would not be more than 1 bcrypt per century You can't really call that a "right" setting when it takes at least as long to log in...

Right was meant as necessary to achieve that effect (sorry, English is not my native language). Obviously this is not a recommendation but just to point out that its configuration ranges from negligible to (on today's computers) forever.

English is my native language, and I think the way you used "right" was fine. At any rate, I understood what you meant.

Re: Security Update

#193

Post by lucb1e »

philliphaydon wrote: post #175

Probably a really stupid question... but how do people detect an intrusion like this?

It's not, but it might have been smart to read a few of the other comments and notice an identical question with two or three answers (depending on your exact time of writing): https://news.ycombinator.com/item?id=19935443

Re: Security Update

#194

Post by tptacek »

kerng wrote: post #116
pvg wrote: post #101

Earlier quoted context omitted.

I'm not sure I follow. If your browser is compromised that's it - it's compromised for everything. Your system is compromised. If I have control over your browser, I don't really need your passwords although I can likely get them out of whatever local password manager you have, to boot.

That's not how it works always. There are tons of compromises that do not imply system compromise, like XSS, or arbitrary browser process memory reads, or extension bugs, or java ghost scripts, etc...

XSS isn't a browser compromise.

What's a "java ghost script"?

Re: Security Update

#195

Post by inglor »

chii wrote: post #157
dagenix wrote: post #148

Earlier quoted context omitted.

> But if you use an alias (and only reveal your real name after the company agrees to interview you), then it's not a problem either! Do you do that? Do you know anyone that does? If so, how do people react to it?

i use an alias on stackoverflow, and i use an alias here on HN! My google profile is also an alias. My facebook profile is also an alias. My twitter, same. And if i had a linked-in profile, it would be an alias too. Some of those alias may be the same, but some i deliberately make different, so that i can choose whether others can associate different aliases together as the same person. Why anyone puts their real nam…

It took me roughly 20 seconds to find your real name out by clever googling and your HN comment history. You can probably do the same to me.

An alias is not privacy :]

Re: Security Update

#196

Post by 0xffff2 »

rcfox wrote: post #61
9nGQluzmnq3M wrote: post #47

Earlier quoted context omitted.

I would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.

10 years ago, almost to the day, they had a password vulnerability involving unsalted hashes. So not plain text, but who knows if they've learned the right lessons? https://blog.codinghorror.com/i-just-logged-in-as-you-how-it...

Unless I'm badly misreading something, the unsalted hashes in that post were on some other (unspecified) site unrelated to Stack Overflow.

Re: Security Update

#197

Post by philliphaydon »

lucb1e wrote: post #193
philliphaydon wrote: post #175

Probably a really stupid question... but how do people detect an intrusion like this?

It's not, but it might have been smart to read a few of the other comments and notice an identical question with two or three answers (depending on your exact time of writing): https://news.ycombinator.com/item?id=19935443

Thanks. I was reading on my phone on the train, comments on the app aren't always easy to follow.

Re: Security Update

#198

Post by AstralStorm »

thaumasiotes wrote: post #138
AstralStorm wrote: post #127

Earlier quoted context omitted.

No, MD5 has about 18 bit collision strength. Combined with predictable salting practice, this is crackable with a calculator. Welcome to Merkle-Damgard construction allowing any prefix or suffix. Given random salt (random placed or mixed) or HMAC, you have to use the more complex preimage attack at 123 bits. This is crackable with a medium sized botnet or a supercomputer. 48 THash is an underestimate. Specialized har…

At 123 bits, you're five bits short of the 128 bits I calculated with. I don't think a medium sized botnet can rise to the level of doing 8 quadrillion years of work within your lifetime. What problem are you trying to solve? As I understand it, we're discussing enumerating the hash space, such that: 1. You are given a hashed value, such as 2b0f4e60b80da7ef1e84573d764f1bf4 . 2. The value is someone's hashed password.…

You do not do this by brute force.

You can assume the system uses a certain salt pattern, e.g. 4 byte prefix or 8 byte prefix or suffix. This can reduce work from full crack to some 40 bit crack. (Guess salt then presume stupid concat scheme, use collision attack to get matches.) That one is doable on a modern PC on a GPU. It is a targetted attack. The mass variant are salted rainbow tables.

You usually do not even have to recover actual password to use credentials associated with the hash.

Re: Security Update

#199

Post by rcfox »

0xffff2 wrote: post #196
rcfox wrote: post #61

Earlier quoted context omitted.

10 years ago, almost to the day, they had a password vulnerability involving unsalted hashes. So not plain text, but who knows if they've learned the right lessons? https://blog.codinghorror.com/i-just-logged-in-as-you-how-it...

Unless I'm badly misreading something, the unsalted hashes in that post were on some other (unspecified) site unrelated to Stack Overflow.

In the first sentence, he links to a previous post where it's made more clear that he's talking about Stack Overflow.

> I found what one could call a security hole in Stackoverflow. I'm curious enough to go digging around for holes, but too ethical to actually do anything with them.

Re: Security Update

#200

Post by anticensor »

majewsky wrote: post #164
viraptor wrote: post #108

Earlier quoted context omitted.

Since it's users, maybe call it a directory... And since it's changing, maybe even an Active Directory? Like this https://aws.amazon.com/directoryservice/ ?

But then we need some sort of Protocol to Access the Directory . It should be something Lightweight , ideally. ;)

LDAP?
Post reply on HN