Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bcrypt at 25

usenix.org

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Bcrypt at 25

#71

Post by kentonv »

re-thc wrote: post #58
candiddevmike wrote: post #3

I'd like to use Argon2 for web stuff but Web Crypto doesn't support it yet ( https://github.com/WICG/proposals/issues/59 ) and the WASM flavor creates problems with bundling and testing. Stuck with PBKDF2 for now...

I wonder if it'd get anywhere. There's not enough CPU/memory allocated in a lot of these platforms to make it work e.g. Deno deploy and Cloudflare workers (bundled) has 50ms of CPU time.

Cloudflare Workers "Bundled" is a legacy mode that is not the default these days. Unbound mode (the default for paid subscriptions) offers 30s CPU time.

Re: Bcrypt at 25

#72

Post by gchamonlive »

throwawaaarrgh wrote: post #54
gchamonlive wrote: post #11

Earlier quoted context omitted.

> The fact that most Cloud software today still tells devs to give it a static infinitely-lived authentication key is absurd. We can do way better. I could be misunderstanding your point, but cloud software is encouraged to rely on infrastructure introspection and role inheritance to achieve machine-to-machine authentication. There is also the problem when authenticating between user owned services, which can be achi…

I'm saying we should remove the 'encouragement' and make secure operation the only mode. When there's a new more secure practice, we should use abstractions that make switching to the new mode as simple as changing some external dependency. The mechanism should be abstracted away into something that isn't code, like how running a program with arguments and stdin isn't reliant on some particular programming language.…

That would most likely require an API gateway of sorts to handle the security procedures transparently. Build bare APIs and run them isolated, exposed by a layer that provides security services through composition.

Re: Bcrypt at 25

#73

Post by djee »

Overlooked in the (excellent) article and interesting for cracking bcrypt passwords: FPGAs, see e.g. https://scatteredsecrets.medium.com/bcrypt-password-cracking...>.

Re: Bcrypt at 25

#74

Post by qingcharles »

samtho wrote: post #29
qingcharles wrote: post #22

Earlier quoted context omitted.

I was incapacitated for many years and my phone plan lapsed, so I lost the number. My email account lapsed and so did all my domains, so I lost access to all my email addresses. I now have about 1000 online accounts that I have no way to access because there is no way to authenticate myself. 2FA can be a real pain in some situations, even though I still advise everyone I know to enable it on their most sensitive acco…

What you went through must have been really awful, I’m sorry that happened to you. That being said, this sounds like a rare occurrence. I’m sure since then you’ve created some contingency plan especially if there is a potential for a repeat. This actually highlights one of my fears of everything being tied to a phone number because you can never truly own it and it can be canceled or you could be sim-swapped.

You would have think I would learn. But no, it happened all over again last year, and I again lost my phone number and access to my email, but this time a friend managed to renew all but one of my domains, so I've managed to access to about 50% of the new accounts I created. And all my possessions were burned up in a fire this time, so I lost all my ID, passport, birth certificate, SSN card etc, which made things ever harder - BUT my landlord saved my actual phone handset with all my TOTP codes on it, which helped a lot!

Let me be a lesson to everyone. Plan for total disaster. Have a plan B and plan C. Don't go through all the work I went through to get your life back on track.

Re: Bcrypt at 25

#75

Post by franciscop »

throwawaaarrgh wrote: post #53
franciscop wrote: post #25

Earlier quoted context omitted.

> does not require the dev to implement their own "hooks" into its methods > tell the framework how to work [...] and just send it data in the way it expects What is that, if not also "hooks"? I've long thought about this and tried many different solutions, and there's only 2 sane points to implement a library/framework like this in an unopinionated way IMHO (without prescribing the DB schema, etc): you provide a lib…

> in an unopinionated way IMHO (without prescribing the DB schema, etc) I'm actually suggesting the most opinionated thing imaginable. Definitely it would need its own schema, database (logical database; you could still put it in the same SQL server instance). I've implemented this before, it works fine. Basically imagine that your app can only talk to some login system through a command-line tool, and the command li…

So how do developers e.g. add a new field to the User schema if needed for the business? Or customize the login page? Or ...

Now you have a CMS like Wordpress, no longer a library or even framework, which has so many moving parts that is def not "secure by default".

Re: Bcrypt at 25

#76

Post by re-thc »

kentonv wrote: post #71
re-thc wrote: post #58

Earlier quoted context omitted.

I wonder if it'd get anywhere. There's not enough CPU/memory allocated in a lot of these platforms to make it work e.g. Deno deploy and Cloudflare workers (bundled) has 50ms of CPU time.

Cloudflare Workers "Bundled" is a legacy mode that is not the default these days. Unbound mode (the default for paid subscriptions) offers 30s CPU time.

Sad to hear - until Unbound has more features such as more memory the bundled mode is useful in the common case to be "legacy".

Re: Bcrypt at 25

#77

Post by redeeman »

qingcharles wrote: post #74
samtho wrote: post #29

Earlier quoted context omitted.

What you went through must have been really awful, I’m sorry that happened to you. That being said, this sounds like a rare occurrence. I’m sure since then you’ve created some contingency plan especially if there is a potential for a repeat. This actually highlights one of my fears of everything being tied to a phone number because you can never truly own it and it can be canceled or you could be sim-swapped.

You would have think I would learn. But no, it happened all over again last year, and I again lost my phone number and access to my email, but this time a friend managed to renew all but one of my domains, so I've managed to access to about 50% of the new accounts I created. And all my possessions were burned up in a fire this time, so I lost all my ID, passport, birth certificate, SSN card etc, which made things eve…

feel free to not respond, but... what happened to you?

Re: Bcrypt at 25

#78

Post by qingcharles »

redeeman wrote: post #77
qingcharles wrote: post #74

Earlier quoted context omitted.

You would have think I would learn. But no, it happened all over again last year, and I again lost my phone number and access to my email, but this time a friend managed to renew all but one of my domains, so I've managed to access to about 50% of the new accounts I created. And all my possessions were burned up in a fire this time, so I lost all my ID, passport, birth certificate, SSN card etc, which made things eve…

feel free to not respond, but... what happened to you?

It's a long story. Illegally arrested for a crime I didn't commit. Spent almost 10 years in jail because I couldn't get access to my money to pay my bond. Charges were dismissed by the court after five years, but as I was walking out of the jail they arrested me for other charges I wasn't guilty of. Spent another five years waiting for trial on those; finally got out of jail for a few months; was harassed by the police, Tweeted about it, sentenced to five months in jail for a Tweet which basically said "LOL here come the police again to harass me"; went to trial on the other charges, judge is mad about the Tweet, finds me guilty without a shred of evidence being offered. Sentenced to maximum sentence, despite no evidence of guilt; already served all the time so should have been released, but authorities won't accept the address I gave them for parole; sent to a supermax prison for three months, then a minimum prison for another month, then released; waiting for exoneration in a few months on appeal.
Post reply on HN