Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI stole an Instapaper server in an unrelated raid

blog.instapaper.com

Post reply on HN
Print view View original

121–130 of 263 posts

Re: The FBI stole an Instapaper server in an unrelated raid

#121

Post by tomjen3 »

xuki wrote: post #75
notatoad wrote: post #35

Earlier quoted context omitted.

this is not shared hosting. the server taken belonged to instapaper. being located in the same datacenter should not be grounds for seizure. if you're looking for a metaphor, think about a self-storage facility ([one of these places]( http://www.moversandpackers.org/wp-content/uploads/2010/10/s... ). imagine you're renting one of those units, and somebody renting a unit on the other side of the yard is a drug dealer.…

The server belonged to Digital One. I didn’t own the hardware — I was leasing it from DigitalOne.

How does that matter? You also lease the storage locker...

Re: The FBI stole an Instapaper server in an unrelated raid

#122

Post by aphrax »

thaumaturgy wrote: post #96
tptacek wrote: post #92

Earlier quoted context omitted.

As a geek let me just say that it is all love with me and the geeks. Just: in this case, you can just take the defaults and be better off.

OK. By the way, in case you haven't heard it lately, thanks for hanging around and demystifying this stuff for so many people. It's a huge help.

as is your comment.

Re: The FBI stole an Instapaper server in an unrelated raid

#123

Post by owenmarshall »

tptacek wrote: post #60
seiji wrote: post #52

Earlier quoted context omitted.

scrypt slides: http://www.tarsnap.com/scrypt/scrypt-slides.pdf Takeaway: Cost to crack one MD5 password: $1. Cost to crack one scrypt password: $50M to $200B. You want your login to be slow compared to the rest of your application. It's okay to take half a second to verify a login.

scrypt is better than bcrypt, but not by the same margin that bcrypt is better than salted hashes. Salted hashes are a straight-up vulnerability. bcrypt is a best practice. Note that almost nobody uses scrypt. We don't recommend it, not because it's insecure, but because it's painful to implement for most companies. But use either. Or just use PBKDF2. All of the adaptive hashes are fine .

    > All of the adaptive hashes are fine.
I am so glad you say this.

I can't count the arguments I've heard centered around what is The One True Way to store passwords... this topic turns every programmer on the planet into an instant Crypto Expert (TM).

STFU and use one. Hell, glib's crypt() lets you pick any of three computationally expensive schemes, so use one of those.

Re: The FBI stole an Instapaper server in an unrelated raid

#126

Post by ktsmith »

WettowelReactor wrote: post #110
ktsmith wrote: post #61

Earlier quoted context omitted.

It's doubtful the evidence was illegally obtained. The warrant was probably for the hardware, and was probably overly broad allowing for the removal of more than was necessary. That's been the routine since at least the mid 90s. There are plenty of cases where the FBI has walked into a data center shown a warrant and walked out with complete racks of equipment most unrelated to their actual search because the warrant…

If the warrant allows them to do so then yes it is legal although we should hold judges accountable. Voting in responsible judges is more important than legislatures IMHO as they tend to have a more direct impact on our personal lives. That being said I just see a lot of comments mentioning the imperative to preserve evidence and chain of custody which is important but completely subordinate to staying within the bou…

You'll get no argument from me about holding judges accountable it's an interesting issue though. Was the warrant issued by a state or federal judge? Federal judges are appointed for life and not elected so the people can't exactly kick them out of office during the next election.

Re: The FBI stole an Instapaper server in an unrelated raid

#128

Post by foobarbazoo »

midnightmonster wrote: post #5
nbpoole wrote: post #4

So, the FBI has a copy of Instapaper's complete database and a copy of their website code. The database includes: - Salted SHA-1 hashed passwords for Instapaper - Encrypted passwords for linked Pinboard accounts (with the encryption key stored in the website code) - OAuth tokens for linked Facebook/Twitter/Tumblr accounts (and presumably also the secret keys used by Instapaper to use those tokens). That's (potentiall…

Perhaps even more important, they have a list of hundreds (thousands?) of pages I thought were interesting enough to read later. Seems like a fine base from which to build or enhance profiles of thousands of citizens.

Even better, they can use that information to build or enhance profiles WITHOUT getting any kind of judicial approval or oversight. Yay, Patriot Act (not).

Re: The FBI stole an Instapaper server in an unrelated raid

#129

Post by encoderer »

Xk wrote: post #119
encoderer wrote: post #113

Earlier quoted context omitted.

Right, which is the reason why "perfect in every respect" and "freakishly fast" are mutually exclusive in a hashing algorithm. A "perfect in every respect" hash then would be one that takes a consistent, acceptably-long time. Some large fraction of a second perhaps. Of course, this fictional hash wouldn't be the right choice for everything. But for password hashing, it's a good start.

(Edit: see child comment -- I was responding to something other than what was intended. I'm leaving this here for clarity, but you can ignore it.) No, not really. Hashing functions aren't designed for passwords, they're mainly used for integrity checks and other uses which need to be fast: why do you think one of the axes the SHA-3 hashes are competing on is speed? You have your 10gb file and want to send it to your…

Woah, slow down, I think you whipped up a 4 paragraph reply before you ever got to my last sentence.

Or, go on and tell me more about all the things hashes are used for as if I just fell off the turnip truck.

This discussion is not about checksums on files. It's abotu passwords. And your "perfect hash" in your example about passwords is "freakishly fast." In fact, like the other guy that replied to me mentioned, this is the entire point of the workfactor in bcrypt, right?

Of course, bycrypt is really, really not meant for checksums. Good thing nobody was talking about checksums then.

Re: The FBI stole an Instapaper server in an unrelated raid

#130

Post by mrlase »

16BitTons wrote: post #47
mrcharles wrote: post #2

All the more reason for data havens to exist. Run your server from a country where the police can't just take it with impunity.

Do you have any suggestions on safe countries? As far as I can tell, the USA is still has the best mixture of freedom and protection available.

The Netherlands, Sweden, etc. provide pretty good coverage and is where a lot of the seedboxes for torrenting are held. If you have something you want the government to have a almost nonexistent (depending on what it is) chance of getting to, go with Russia, China, etc. and other countries that probably don't have the best relations with the United States.
Post reply on HN