Password leaks bigger than first thought • Hacker News Board

Re: Password leaks bigger than first thought

#21

Post by latchkey » Sat, Jun 09, 2012, 10:38 PM UTC

zizee wrote: post #16

What do people think about outsourcing your authentication to someone else? Full Disclosure: I'm currently working on a brandable authentication host ( http://www.authic.com ) that will outsource the pain of storing your password hashes securly and provide your web app with slick a user account UX.

I'm offering my users Browserid and/or Facebook in order to login. Works great and passwords are definitely something I'd rather not deal with. Also saves me from having to implement all sorts of stuff like forgot password, forgot username, etc.

Re: Password leaks bigger than first thought

#22

Post by duskwuff » Sat, Jun 09, 2012, 10:40 PM UTC

rpearl wrote: post #19

waffle_ss wrote: post #7

Unsurprising that >95% of the password hashes have been broken. I remember being annoyed when I signed up for LinkedIn (just checked my tweet history - it was 2010/06/10) because they were only allowing 16 characters in the password field. EDIT: Whoops, guess I should have done some napkin math before claiming that there are rainbow tables that cover that area. /me slaps wrist

I mean... there are surely not rainbow tables that span all 62^16 16-character passwords consisting of alphanumerics only: that is 646,081,519 zettabytes of hashes (62^16 * 128 bits). There are clearly rainbow tables which span a more useful dictionary of passwords, though--and certainly all the most common passwords.

Even if we conservatively assume that you only need lowercase characters, and that you need one bit per password, that's still 26^16 bits = 4.6 ZB, about fifteen times the total capacity of every hard disk sold by Seagate in 2011 (330 EB).

Re: Password leaks bigger than first thought

#23

Post by zizee » Sat, Jun 09, 2012, 10:43 PM UTC

latchkey wrote: post #21

zizee wrote: post #16

What do people think about outsourcing your authentication to someone else? Full Disclosure: I'm currently working on a brandable authentication host ( http://www.authic.com ) that will outsource the pain of storing your password hashes securly and provide your web app with slick a user account UX.

I'm offering my users Browserid and/or Facebook in order to login. Works great and passwords are definitely something I'd rather not deal with. Also saves me from having to implement all sorts of stuff like forgot password, forgot username, etc.

Do you also offer your own login forms?

Re: Password leaks bigger than first thought

#24

Post by zizee » Sat, Jun 09, 2012, 10:49 PM UTC

TrevorJ wrote: post #2

Does the number of passwords in the hashed list matter in terms of how easy or hard they will be to crack? Does this have implications for a rainbow table-type attack?

It would increase the likelihood of more common passwords being present in the list giving the attackers insight into what hashing technique was being used to store the passwords.

But the difference between 10,000 hashes and 10,000,000 would not make it easier to crack.

Re: Password leaks bigger than first thought

#25

Post by latchkey » Sat, Jun 09, 2012, 10:52 PM UTC

zizee wrote: post #23

latchkey wrote: post #21

Earlier quoted context omitted.

I'm offering my users Browserid and/or Facebook in order to login. Works great and passwords are definitely something I'd rather not deal with. Also saves me from having to implement all sorts of stuff like forgot password, forgot username, etc.

Do you also offer your own login forms?

Nope. Feel free to play around and try it yourself. I think the experience is not 100% perfect but is pretty darn good. That said, I'm always open to constructive feedback. www.voo.st

Re: Password leaks bigger than first thought

#26

Post by zizee » Sat, Jun 09, 2012, 10:55 PM UTC

lucian1900 wrote: post #4

TrevorJ wrote: post #2

Does the number of passwords in the hashed list matter in terms of how easy or hard they will be to crack? Does this have implications for a rainbow table-type attack?

I guess the more you have, the more information you have about the salt used. I'm not sure it'd be useful though. And many of these hashes aren't salted anyway.

Often people will store the password salt alongside their password hashes*, so if someone has the user table they would have the salts.

---

At Authic.com we are investigating the practicalities of storing salts in a separate database from the password hashes.

Re: Password leaks bigger than first thought

#27

Post by waffle_ss » Sat, Jun 09, 2012, 10:58 PM UTC

rpearl wrote: post #19

waffle_ss wrote: post #7

Unsurprising that >95% of the password hashes have been broken. I remember being annoyed when I signed up for LinkedIn (just checked my tweet history - it was 2010/06/10) because they were only allowing 16 characters in the password field. EDIT: Whoops, guess I should have done some napkin math before claiming that there are rainbow tables that cover that area. /me slaps wrist

I mean... there are surely not rainbow tables that span all 62^16 16-character passwords consisting of alphanumerics only: that is 646,081,519 zettabytes of hashes (62^16 * 128 bits). There are clearly rainbow tables which span a more useful dictionary of passwords, though--and certainly all the most common passwords.

You are absolutely correct; I should have actually done the 5-second calculation before writing that instead of relying on my flawed memory.

Looks like the publicly available rainbow tables go out to 7 characters with special chars included, which comes out to a much more reasonable 3.2 TB (using 62 chars).

Re: Password leaks bigger than first thought

#28

Post by zizee » Sat, Jun 09, 2012, 11:01 PM UTC

latchkey wrote: post #25

zizee wrote: post #23

Earlier quoted context omitted.

Do you also offer your own login forms?

Nope. Feel free to play around and try it yourself. I think the experience is not 100% perfect but is pretty darn good. That said, I'm always open to constructive feedback. www.voo.st

Looks nice. My biggest feedback is that there is no "Join now" link/button, just a login. I presume that if you try and login without an account it will go ahead and sign you up, but it is not obvious.

Also the line "All events on Voost are managed by an organization" - I'm not sure what that means, what is an organisation? Is that me?

Re: Password leaks bigger than first thought

#29

Post by zizee » Sat, Jun 09, 2012, 11:08 PM UTC

waffle_ss wrote: post #7

Unsurprising that >95% of the password hashes have been broken. I remember being annoyed when I signed up for LinkedIn (just checked my tweet history - it was 2010/06/10) because they were only allowing 16 characters in the password field. EDIT: Whoops, guess I should have done some napkin math before claiming that there are rainbow tables that cover that area. /me slaps wrist

But still a good point: Why limit your password length? My online banking is the worst offender that I know. Not only do they insist that the password is no longer than 8 characters, it HAS to be 8 characters. Madness!

Re: Password leaks bigger than first thought

#30

Post by Havoc » Sat, Jun 09, 2012, 11:09 PM UTC

Unsalted hashes. Wow. What a bunch of amateurs.

Also, 10 internet points says at least one other major website will fall too within 2 weeks. Someone has found a new exploit & is trying various sites & collecting hashes.