Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

League of Legends database compromised, passwords hashed without salt

euw.leagueoflegends.com

Post reply on HN
Print view View original

91–100 of 109 posts

Re: League of Legends database compromised, passwords hashed without salt

#91

Post by IsTom »

confluence wrote: post #22

Is it just me or have the number of announcements on HN about password leaks gone up in the last few weeks? I think availability bias is kicking in, with each additional announcement, more links about announcements are posted (for karma) or more sites feel like they can announce, under the cover of larger leaks, that they themselves have been compromised. Probably just me. [1] - http://en.wikipedia.org/wiki/Availabil…

I haven't seen what was the weakness exploited in all these attacks -- perhaps it's a common vulnerability that was discovered by a group of bad guys.

Re: League of Legends database compromised, passwords hashed without salt

#92

Post by DougBTX »

FreakLegion wrote: post #84
mrb wrote: post #74

Earlier quoted context omitted.

A good cryptographer assumes that a custom hash function does not prevent rainbow table attacks, because he should not assume the algorithm will remain secret (security by obscurity, yadi, yada). The right way to prevent a rainbow table attack is to computationally prevent it via unique salts.

Unique salts are absolutely the correct way to rainbow-proof a database of hashes[1]. But a novel hash function will still do the trick and isn't comparable to using a single salt across the entire database, as you originally claimed. Reverse engineering a novel hash function, while theoretically possible, isn't a capability possessed by the folks dumping passwords from LinkedIn or Riot. And even if it were, doing so…

But a novel hash function will still do the trick and isn't comparable to using a single salt across the entire database, as you originally claimed.

I'm not sure I understand this point, what is the criteria for a function to be novel?

This function produces different hashes from most other hash functions, eg, it is new and possibly novel, but is equivalent to using a single salt across a database:

    function novelHash(password) {
        return md5("novelHash" + password);
    }

Re: League of Legends database compromised, passwords hashed without salt

#93

Post by xkcdfanboy »

pestaa wrote: post #86
xkcdfanboy wrote: post #78

Earlier quoted context omitted.

Yes but it's not like the random hacker has a 600 gig rainbow table for MD5('DATSALT' + PW). If you REALLY want to do the right thing when it comes to storing passwords, you need to use a hash algo that is computationally hard enough to brute force, it should take at least .5 sec on a good computer to compute. Every couple years, you should add another pass of the algorithm, ie. F(F(X)), to compensate for faster comp…

Not an expert, but I believe rehashing the hashes is a good way to decrease entropy.

As long as the salt is added for each recursive iteration, it should destroy any kind of cryptographic hints given by hashing a hash. So you shouldn't be doing F(F(F(X))) rather it should be F(SALT + F(SALT + F(SALT+X)))

But anyhow, I was talking about increasing the security of an already-existing hash algorithm. Even if the recursive hashing isn't that much more secure, it definitely isn't less secure than one pass...

Re: League of Legends database compromised, passwords hashed without salt

#94

Post by mingpan »

Keep in mind that the target audience of this post is a largely nontechnical user base. These days, average people are getting a general idea of the meaning of "encrypt" due to the prevalence of, e.g. SSL in e-commerce, but not necessarily the meaning of "hash". Thus, it's not uncommon that places will intentionally misuse these words in order to reach a nontechnical audience.

Re: League of Legends database compromised, passwords hashed without salt

#95

Post by Karunamon »

drivebyacct2 wrote: post #61

Good god, this topic is discussed to death and yet there are spreading very inaccurate, insecure crap in this thread. I think everyone needs to stop giving advice and speculating about what is "good" and defer to a security expert or a set of codified best practices. I just don't understand how some people seem to understand salting, hashes or encryption but not enough to understand why unique-per-user salts are impo…

>but not enough to understand why unique-per-user salts are important

I don't think that's been covered in this thread. If the main point of salting is to make rainbow tables ineffective, a single DB-wide hash still does that. Presumably if a hacker gets a copy of your entire database, they still don't have a copy of your hashing function with that salt. So then they're reduced to brute force.

Something else that I just thought of is, if you're salting per user, where does that salt get stored? A secondary database?

..And then come to find out it's been discussed down thread. Oops.

Re: League of Legends database compromised, passwords hashed without salt

#96

Post by Karunamon »

newobj wrote: post #68
gcr wrote: post #67

LinkedIn, LastFM, League of Legends... What is with this disturbing trend of websites beginning with L being cracked all in the same week?

Well obviously the bad guys are just going through the phone book one by one.

Well we haven't had a good Microsoft service hack for a while. Microsoft Xbox Live next?

Re: League of Legends database compromised, passwords hashed without salt

#97

Post by [deleted] »

Karunamon wrote: post #95
drivebyacct2 wrote: post #61

Good god, this topic is discussed to death and yet there are spreading very inaccurate, insecure crap in this thread. I think everyone needs to stop giving advice and speculating about what is "good" and defer to a security expert or a set of codified best practices. I just don't understand how some people seem to understand salting, hashes or encryption but not enough to understand why unique-per-user salts are impo…

>but not enough to understand why unique-per-user salts are important I don't think that's been covered in this thread. If the main point of salting is to make rainbow tables ineffective, a single DB-wide hash still does that. Presumably if a hacker gets a copy of your entire database, they still don't have a copy of your hashing function with that salt. So then they're reduced to brute force. Something else that I j…

[deleted]

Re: League of Legends database compromised, passwords hashed without salt

#98

Post by smoyer »

drivebyacct2 wrote: post #87
drivebyacct2 wrote: post #61

Good god, this topic is discussed to death and yet there are spreading very inaccurate, insecure crap in this thread. I think everyone needs to stop giving advice and speculating about what is "good" and defer to a security expert or a set of codified best practices. I just don't understand how some people seem to understand salting, hashes or encryption but not enough to understand why unique-per-user salts are impo…

To whomever downvoted me, I've seen people suggest on this thread or ones in the last 24 hours that: - symmetric encryption is appropriate for sites' storing passwords - md5 is okay - site-wide salts are just as secure as user specific salts and more. Some of these were suggested by people that have far, far more karma than me. Some were suggested by people that had had this explained to them in previous threads and…

Don't forget the guy that salted his own passwords - googlepassword, linkedinpassword, yahoopassword (yeah ... he probably has a Yahoo account).

Re: League of Legends database compromised, passwords hashed without salt

#99

Post by smoyer »

mrleinad wrote: post #10

That sounds like a really proffessional letter to their users. Brief, honest, precise, and they clearly state what their action items to prevent this from ever happening again will be. I like it a lot.

Is "info" acceptable in professional business communications now? I don't mind that it's friendly and informal, but I also wouldn't call it professional.

Re: League of Legends database compromised, passwords hashed without salt

#100

Post by facorreia »

To me, it adds insult to injury when companies that fail to take the most basic, well-known measures to protect their login databases always tell us how much they value the security of user information.

That would only be acceptable if the next words were, "and therefore we have fired the CTO and all programmers involved".

Post reply on HN