Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Dropbox account gave me stomach ulcers

reddit.com

Post reply on HN
Print view View original

111–120 of 129 posts

Re: A Dropbox account gave me stomach ulcers

#111

Post by vezycash »

koolba wrote: post #89
vezycash wrote: post #79

Earlier quoted context omitted.

I've got ulcer. My last ulcer attack, 5 years had me rolling on the floor. Since then, I avoided stress. Ate at the slightest hint of hunger, even as I grew a pot belly. Also, I avoided situps, cos the muscle pains felt like ulcer attacks. There's this specific food that I love. It's eaten RAW but often prepared in a not too hygienic manner. Since I banned myself from eating it, I've slowly become able to stay a few…

What’s the food?

It's called garri - popular in most (if not all) west african countries. Here's a video of Nigeria's ex-president eating it.

Re: A Dropbox account gave me stomach ulcers

#112

Post by [deleted] »

phonon wrote: post #108
sneak wrote: post #86

Earlier quoted context omitted.

Bitwarden derives its keys using SHA256 on the passphrase and a hilariously low iteration count. The developer refuses to acknowledge it as a security risk, and actually caps the max iterations you can configure, both on the client and the server. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 “It was audited” is meaningless if the audit missed this, or reported this and t…

It looks like people are getting confusing between using SHA256 directly as a key stretching mechanism, and what PBKDF2-SHA256 is. https://crypto.stackexchange.com/a/61306 Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/... Given Bitwarden allows almost 10x that, not sure I see the issue.

[deleted]

Re: A Dropbox account gave me stomach ulcers

#113

Post by sneak »

phonon wrote: post #108
sneak wrote: post #86

Earlier quoted context omitted.

Bitwarden derives its keys using SHA256 on the passphrase and a hilariously low iteration count. The developer refuses to acknowledge it as a security risk, and actually caps the max iterations you can configure, both on the client and the server. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 “It was audited” is meaningless if the audit missed this, or reported this and t…

It looks like people are getting confusing between using SHA256 directly as a key stretching mechanism, and what PBKDF2-SHA256 is. https://crypto.stackexchange.com/a/61306 Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/... Given Bitwarden allows almost 10x that, not sure I see the issue.

Bitwarden’s auth protocol allows the server to tell the client that the iteration count is 5000, regardless of the actual iteration count, and the client will send 5000-iteration passphrase-derived material to the bitwarden server (run by the developer in the usual case).

PBKDF-SHA256 is far too fast, even with the HMAC step.

Re: A Dropbox account gave me stomach ulcers

#114

Post by tmikaeld »

sneak wrote: post #113
phonon wrote: post #108

Earlier quoted context omitted.

It looks like people are getting confusing between using SHA256 directly as a key stretching mechanism, and what PBKDF2-SHA256 is. https://crypto.stackexchange.com/a/61306 Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/... Given Bitwarden allows almost 10x that, not sure I see the issue.

Bitwarden’s auth protocol allows the server to tell the client that the iteration count is 5000, regardless of the actual iteration count, and the client will send 5000-iteration passphrase-derived material to the bitwarden server (run by the developer in the usual case). PBKDF-SHA256 is far too fast, even with the HMAC step.

In the Audit they pointed this out, but didn't see it as a huge issue.

I'd rather they use Argon2id to be as safe as can be.

However, I've not yet seen a fully cross-platform javascript-only implementation of Argon2 at all, which is problematic for an extension.. :-/

UPDATE: There actually exist an Argon2 implementation that's used by another vault, https://www.npmjs.com/package/argon2-browser

Re: A Dropbox account gave me stomach ulcers

#115

Post by phonon »

sneak wrote: post #113
phonon wrote: post #108

Earlier quoted context omitted.

It looks like people are getting confusing between using SHA256 directly as a key stretching mechanism, and what PBKDF2-SHA256 is. https://crypto.stackexchange.com/a/61306 Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/... Given Bitwarden allows almost 10x that, not sure I see the issue.

Bitwarden’s auth protocol allows the server to tell the client that the iteration count is 5000, regardless of the actual iteration count, and the client will send 5000-iteration passphrase-derived material to the bitwarden server (run by the developer in the usual case). PBKDF-SHA256 is far too fast, even with the HMAC step.

Errr...most systems (like Django) send passwords in plaintext to the server! (Over SSL of course).

The point of PBKDF-SHA256 is to protect the secrecy of passwords if the server is compromised and its password hash db is dumped.

Re: A Dropbox account gave me stomach ulcers

#116

Post by vonseel »

jborichevskiy wrote: post #109
someonehere wrote: post #93

I am not a fan of Dropbox. Stories like this are why I don’t use it. A couple of years ago I inherited managing Dropbox for a company I was at. I’d never really used Dropbox in a more daily use company. I discovered Dropbox wasn’t very IT admin friendly. If you share out a personal folder as your team folder, IT can’t find your folder to share it to new members of your team. The person who owns the folder has to shar…

> The other crappy thing I discovered about Dropbox from that time. I have no way to audit or tell who has what folder. Have felt similar pain with G Suite Drive. Perhaps I simply didn’t find or didn’t have the proper permissions (I wasn’t the top level admin on the org) but at some point I wrote a Python script to output a list of users who had access to each file in our organization. I saw no way of generating this…

Drive can be a nightmare.

Re: A Dropbox account gave me stomach ulcers

#117

Post by distant_hat »

DoingIsLearning wrote: post #51
kyberias wrote: post #48

Earlier quoted context omitted.

What "audit" are we talking about here, though?

Usually when you acquire a company you sign of some intent lettet that shows you are serious about the purchase provided they can pass your smell test. Then after NDA's and a few other docs if a company accepts being purchased they have to give access to their internal docs. Finance books, IT, etc. If during this "due diligence" period the buyers find a major red flag they might pull out, revise the price down, etc.

Having seen a couple of acquisitions what I see is that things go forward because the top execs are close and went to the same school and so on. The technical details shared are light and often don't matter until things are settled and the plebs have to merge everything.

Re: A Dropbox account gave me stomach ulcers

#118

Post by guitarbill »

Gibbon1 wrote: post #36
fortran77 wrote: post #25

Earlier quoted context omitted.

It doesn't matter. The board and CEO will _never_ listen to the CIO and technical team. If they want to do an acquisition, they'll do it. I've seen this at least a dozen times in my 36 year career.

I keep coming back to from the board and CEO's perspective they have a choice, spend a lot of their time and effort to gain market share by investing in their own company. Or acquiring it through an acquisition. Seems like an acquisition is a lot less hassle and risk. And can be done quickly. Most 'problems' can be made to go away by throwing money and fixers at them.

This doesn't always work, see HPE vs Autonomy. That case is incredibly interesting for an insight into how idiotic and lazy execs can be. Usually though, it works out for them, probably by luck. Would be, err, "interesting" if there were more Mike Lynch around to provide similar insight (Autonomy's CEO). Then again, the case is interesting as HPE was willing to litigate, and a certain British tech news outlet picked it up.

Re: A Dropbox account gave me stomach ulcers

#119

Post by sneak »

phonon wrote: post #115
sneak wrote: post #113

Earlier quoted context omitted.

Bitwarden’s auth protocol allows the server to tell the client that the iteration count is 5000, regardless of the actual iteration count, and the client will send 5000-iteration passphrase-derived material to the bitwarden server (run by the developer in the usual case). PBKDF-SHA256 is far too fast, even with the HMAC step.

Errr...most systems (like Django) send passwords in plaintext to the server! (Over SSL of course). The point of PBKDF-SHA256 is to protect the secrecy of passwords if the server is compromised and its password hash db is dumped.

Django’s auth system is for a single site. Bitwarden’s master passphrase protects the key that decrypts my password for every single site I use.

This is not some random webapp. It is a password manager.

Re: A Dropbox account gave me stomach ulcers

#120

Post by dorfsmay »

vezycash wrote: post #111
koolba wrote: post #89

Earlier quoted context omitted.

What’s the food?

It's called garri - popular in most (if not all) west african countries. Here's a video of Nigeria's ex-president eating it.

Have you seen this entry in Wikipedia:

https://en.wikipedia.org/wiki/Garri#Health_implications

> Garri is made from cassava which contains hydrocyanic acid .../... can lead to .../... worsening of ulcers.

Post reply on HN