Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Change your Last.fm password

thenextweb.com

Post reply on HN
Print view View original

51–60 of 152 posts

Re: Change your Last.fm password

#51

Post by soulclap »

cschmidt wrote: post #44
soulclap wrote: post #43

To be 'fair': when Last.fm first launched, md5 was probably 'state of the art'. I mean take a step back, they have been around for like forever. The question is: How would you go on about moving your user database from md5 to a more advanced algorithm? Validate a user's password on log-in and then encrypt it with the new, more secure algorithm?

Yes, that's exactly what you do. In Django 1.4 (the latest), they store passwords using PDKDF2 or bcrypt. The nice thing is that it automatically upgrades the hash function if it used to be something else: _______ Password upgrading When users log in, if their passwords are stored with anything other than the preferred algorithm, Django will automatically upgrade the algorithm to the preferred one. This means that ol…

Great feature. So you alter the password field (extending the length) if needed and when a user signs in it gets auto-updated and Django always tests both/all specified algorithms? Or do you have to add a new database field when moving on? (Sorry for my tl;dr behaviour but while I've got an expert on the line anyway...)

Re: Change your Last.fm password

#52

Post by sliverstorm »

anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops.

Fundamental flaw with that- you can't change your fingerprint if/when it is compromised.

Re: Change your Last.fm password

#53

Post by obituary_latte »

anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords.

It indeed appears that the entire system is broken beyond repair. It seems like it is becoming the norm to expect to be exploited at some point so the de-facto preemption is to have someone to blame. As the manager of a datacenter we recently moved into said "we're here to provide a subject for you to point your finger at should there be a breach".

WTF, industry.

Re: Change your Last.fm password

#54

Post by jackalope »

quesera wrote: post #10
hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

Well, the problem here is that big corps are doing obviously-wrong things with user data. It's not like there's any uncertainty in the industry about how to do things correctly, it's just that these corps and many others are deciding not to. What makes you think they would make better decisions if the technology was called something other than "passwords"? There is no technology that cannot be ruined by ignorant impl…

Let me tell you a secret. Now that I've told you, it's no longer a secret. That's the problem with passwords.

Re: Change your Last.fm password

#55

Post by notlostyet »

soulclap wrote: post #43

To be 'fair': when Last.fm first launched, md5 was probably 'state of the art'. I mean take a step back, they have been around for like forever. The question is: How would you go on about moving your user database from md5 to a more advanced algorithm? Validate a user's password on log-in and then encrypt it with the new, more secure algorithm?

You can also just hash the existing hashes. bcrypt(salt + old_md5). New passwords can use a new MD5-less scheme.

Re: Change your Last.fm password

#56

Post by cschmidt »

soulclap wrote: post #51
cschmidt wrote: post #44

Earlier quoted context omitted.

Yes, that's exactly what you do. In Django 1.4 (the latest), they store passwords using PDKDF2 or bcrypt. The nice thing is that it automatically upgrades the hash function if it used to be something else: _______ Password upgrading When users log in, if their passwords are stored with anything other than the preferred algorithm, Django will automatically upgrade the algorithm to the preferred one. This means that ol…

Great feature. So you alter the password field (extending the length) if needed and when a user signs in it gets auto-updated and Django always tests both/all specified algorithms? Or do you have to add a new database field when moving on? (Sorry for my tl;dr behaviour but while I've got an expert on the line anyway...)

I'm not an expert in any sense, just a Django user. I've never actually looked under the hood, since it just works.

You specify an order of the hash algorithms, putting the one you want first. Switching to bcrypt for me was just a matter of moving it up a few lines in a list.

The password field can probably stay the same length, since it is a hash value anyway. I'm assuming you have a second field that stores the hash algorithm used. When it logs you in, it uses the current algorithm to authenticate you. Then if that technique isn't first on your list, it creates a new, salted hash, and stores both that and the new hash type in the database. Nice and slick.

Re: Change your Last.fm password

#57

Post by jackalope »

markkum wrote: post #7
hpaavola wrote: post #5

Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

If you want something better for your site; check out MePIN https://www.mepin.com/

How do they prevent unauthorized locks, unlocks or transfers? There's virtually no documentation on the site.

Re: Change your Last.fm password

#58

Post by 7952 »

pavel_lishin wrote: post #16
pnathan wrote: post #11

Earlier quoted context omitted.

I would like to see pub/private key implementations for this sort of thing.

I find it so odd that this functionality wasn't baked into web browsers from the beginning.

TLS does allow client authentication using keys. It is a flawed solution as it puts too much importance in protecting the key. What happens when you need to login from an internet cafe? How do you securely move keys between devices? What happens when the machine has malware that steal the keys?

Good security assumes that everything can and will be compromised and provides defence in depth. Client certs do little to help.

Post reply on HN