The FBI stole an Instapaper server in an unrelated raid

Post by meroliph » Thu, Jun 23, 2011, 6:13 PM UTC

mwytock wrote: post #67

getsat wrote: post #36

Earlier quoted context omitted.

> can brute force millions Modern consumer video cards can do billions per second now. You might as well just store them in plaintext instead of using SHA1/MD5 with or without salting. :/

I dont understand. If you can use mixed-cased, letters and symbols you have 26 * 2 + 20 = 72 possible characters. 72^8 >> 1e9 It would still take more than 8 days to brute force at 1 billion/sec. And using a longer password (16 chars?) would make this a very long time. Or is there other trick that makes this fast? Or, is it simply that people don't choose random, long passwords?

Post by tptacek » Thu, Jun 23, 2011, 6:15 PM UTC

IgorPartola wrote: post #68

tptacek wrote: post #41

Earlier quoted context omitted.

No there isn't. You only think that because when geeks discuss anything that involves one or more knobs, a huge debate must necessarily ensue about the proper values of those knobs. Just use the bcrypt defaults. You will be fine. You will in particular be so much better off than salted SHA-1 that this topic will be mooted. Later on, maybe in 5-10 years, you can re-engage with the debate about what a good cost factor…

Thanks. I am just trying to navigate the sea of misinformation that spews forth everywhere about salted hashes vs bcrypt vs scrypt. I can see that lots of people claim that bcrypt is better, but I am not aware of anything about it other than the original paper. Basically, I want to know what the chances are that two months after I implement bcrypt a huge issue with it will be discovered and I'll have to move everythi…

Post by xuki » Thu, Jun 23, 2011, 6:17 PM UTC

notatoad wrote: post #35

yuvadam wrote: post #6

I'm trying to think of an analogy which can explain why this might be reasonable from the FBIs perspective. Suppose you were using a shared storage space (shared servers, or server farm) with several other dudes. One of them is a drug dealer. One day the police/FBI decide to raid the storage space since the drug dealer has been using it to store illegal drugs. Is it not reasonable to consider this collateral damage (…

this is not shared hosting. the server taken belonged to instapaper. being located in the same datacenter should not be grounds for seizure. if you're looking for a metaphor, think about a self-storage facility ([one of these places]( http://www.moversandpackers.org/wp-content/uploads/2010/10/s... ). imagine you're renting one of those units, and somebody renting a unit on the other side of the yard is a drug dealer.…

Post by dkubb » Thu, Jun 23, 2011, 6:20 PM UTC

mrcharles wrote: post #2

All the more reason for data havens to exist. Run your server from a country where the police can't just take it with impunity.

Post by IgorPartola » Thu, Jun 23, 2011, 6:22 PM UTC

tptacek wrote: post #73

IgorPartola wrote: post #68

Earlier quoted context omitted.

Thanks. I am just trying to navigate the sea of misinformation that spews forth everywhere about salted hashes vs bcrypt vs scrypt. I can see that lots of people claim that bcrypt is better, but I am not aware of anything about it other than the original paper. Basically, I want to know what the chances are that two months after I implement bcrypt a huge issue with it will be discovered and I'll have to move everythi…

There is virtually no chance that, after selecting bcrypt, you will be forced to scramble to replace it in 2 months. There is no chance that, after selecting bcrypt, you will be forced to scramble to replace it with salted SHA-1 hashes. bcrypt is strictly better than what you're doing now.