Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

github.com

Post reply on HN
Print view View original

111–120 of 126 posts

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#111

Post by asharp »

bad_user wrote: post #107
ohyes wrote: post #69

Earlier quoted context omitted.

Phishing the password from one user and recovering the salt shouldn't be useful in the first place. The parent example was only meant to show how difficult it is to recover a salt even with multiple examples of its use, not to give a real life example of password hash use. (Which was my point) That said, I don't know how you would obtain a list of hashed passwords without also getting the associated list of salts (wo…

Having the exact salt in the same database as the user data defeats the purpose of the salt. Normally you have a global salt, somewhere in your source-code, which you combine with the per-user generated salt. It also doesn't have to be something obvious in the database (like a column named user_salt :)), you could just use something like HMAC_MD5(global_salt, email + username + joined_date) for each user. Of course,…

How does it defeat the purpose of the salt?

The purpose of the salt is to defeat time/space tradeoff attacks by inflating the required space to the point of impracticality. ie. 20 bits of salt will increase the size of the rainbow table required a million times.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#113

Post by [deleted] »

bad_user wrote: post #108
throwaway64 wrote: post #100

Earlier quoted context omitted.

No it is not, because the salt is stored in a plaintext or easily reversible format somewhere , and has to be in order for authentication to work, if you are in a position to grab the hashes, it will also be trivial to grab the salts. The point of the salt is not to add some padding bits to the password. Salts should be publicly knowable without it causing a loss of security. The one and _only_ use of a salt is to pr…

But isn't the SSH private key also stored in plain text? I mean, yeah, you could also have a password for that key, but then most people use ssh-agent because typing that key every single time is annoying, which means the password is somewhere in memory. Or you could just install a keylogger on it and wait for the user to login. If the user's computer is compromised, a hacker could gain access to his SSH credentials.…

[deleted]

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#114

Post by throwaway64 »

bad_user wrote: post #108
throwaway64 wrote: post #100

Earlier quoted context omitted.

No it is not, because the salt is stored in a plaintext or easily reversible format somewhere , and has to be in order for authentication to work, if you are in a position to grab the hashes, it will also be trivial to grab the salts. The point of the salt is not to add some padding bits to the password. Salts should be publicly knowable without it causing a loss of security. The one and _only_ use of a salt is to pr…

But isn't the SSH private key also stored in plain text? I mean, yeah, you could also have a password for that key, but then most people use ssh-agent because typing that key every single time is annoying, which means the password is somewhere in memory. Or you could just install a keylogger on it and wait for the user to login. If the user's computer is compromised, a hacker could gain access to his SSH credentials.…

>But isn't the SSH private key also stored in plain text?

no, passwording the key encrypts it

>I mean, yeah, you could also have a password for that key, but then most people use ssh-agent because typing that key every single time is annoying, which means the password is somewhere in memory.

ssh-agent does not expose the private key to clients requesting it, thats part of its design, you can however get a login session to whatever hosts it holds keys for.

> Or you could just install a keylogger on it and wait for the user to login. > Isn't that still security by obscurity?

That is much more involved than a hit and run attack where you download the DB, and much more likely to be detected/detectable before any harm is done, via such things as IDS, or just plain not possible due to how a system is locked down (stuff like ssh gateways that are heavily secured, etc).

All this stuff is besides the point anyways, bcrypt/hashed passwords are not about protecting your system from active compromise directly, but its about limiting the damage such compromises can do.

>relying on the slowness of an algorithm like bcrypt

the point of bcrypt isnt JUST that it is slow, its that each step requires the data from the previous step, many thousands (or tens of thousands, or even millions) of times over, that makes it impossible to parallelize across many GPU cores or similar arrangements, thats a huge part of the weakness of stuff like plain hashing/salting, its trivial to parallelize and to scale up that parellelization till you are generating billions, or even trillions of hashes a second, that approch is totally useless on bcrypt.

Another important factor in bcrypt is that you can up the amount of rounds trivially without having everyone reset their passwords, so your password DB can get stronger as technologies advance.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#115

Post by derleth »

bad_user wrote: post #108
throwaway64 wrote: post #100

Earlier quoted context omitted.

No it is not, because the salt is stored in a plaintext or easily reversible format somewhere , and has to be in order for authentication to work, if you are in a position to grab the hashes, it will also be trivial to grab the salts. The point of the salt is not to add some padding bits to the password. Salts should be publicly knowable without it causing a loss of security. The one and _only_ use of a salt is to pr…

But isn't the SSH private key also stored in plain text? I mean, yeah, you could also have a password for that key, but then most people use ssh-agent because typing that key every single time is annoying, which means the password is somewhere in memory. Or you could just install a keylogger on it and wait for the user to login. If the user's computer is compromised, a hacker could gain access to his SSH credentials.…

From throwaway64, who is dead:

">But isn't the SSH private key also stored in plain text?

no, passwording the key encrypts it

>I mean, yeah, you could also have a password for that key, but then most people use ssh-agent because typing that key every single time is annoying, which means the password is somewhere in memory. Or you could just install a keylogger on it and wait for the user to login.

ssh-agent does not expose the private key to clients requesting it, thats part of its design, you can however get a login session to whatever hosts it holds keys for.

> Isn't that still security by obscurity?

That is much more involved than a hit and run attack where you download the DB, and much more likely to be detected/detectable before any harm is done, via such things as IDS, or just plain not possible due to how a system is locked down (stuff like ssh gateways that are heavily secured, etc).

>Instead we should rely on computational complexity ... there are limits to what we can compute when exponential complexity is involved.

the point of bcrypt isnt JUST that it is slow, its that each step requires the data from the previous step, many thousands of times over, that makes it impossible to parallelize across many GPU cores or similar arangements, thats a huge part of the weakness of stuff like plain hashing/salting, its trivial to parallelize and to scale up that parellelization till you are generating billions, or even trillions of hashes a second, that approch is totally useless on bcrypt."

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#116

Post by almost »

dhimes wrote: post #26
seabee wrote: post #10

Earlier quoted context omitted.

If using MD5 is all you do, you'd still be susceptible to brute force attacks . MD5 is a really fast hash to compute, salting or not. The solution is to pick a better algorithm and learn how to use it securely. That probably won't happen unless all the ridiculous PHP 'security' tutorials are erased from the history of the internet and only correct methods are shown.

Do you have a reference that you would consider "the minimum you should know?" And, perhaps, maybe one somewhat better than that one? TIA.

Just remember "use bcrypt" and you should be fine. There is almost certainly a library for it for your language.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#120

Post by [deleted] »

TillE wrote: post #20
aparadja wrote: post #14

Earlier quoted context omitted.

Perhaps I should have written it as "unsalted MD5" instead of "plain MD5" to avoid confusion. Unsalted MD5, in my opinion, is horrible. MD5 plays it's part in the mess: it's quick to calculate, which means that anybody can churn out huge lookup databases. Missing salts make those databases universally usable.

> huge lookup databases "Huge" being the key word here. Try searching for the md5sums of arbitrary 8-character alphanumeric passwords. You won't find many results. 62^8 is a big number.

[deleted]
Post reply on HN