Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

ieeelog.com

Post reply on HN
Print view View original

71–80 of 138 posts

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#71

Post by ghshephard »

masklinn wrote: post #68
ghshephard wrote: post #48

Earlier quoted context omitted.

One of these days we will shut down the "Salting password hashes is a useful thing to do." meme from 1994. See: http://codahale.com/how-to-safely-store-a-password/ for details.

> One of these days we will shut down the "Salting password hashes is a useful thing to do." Uh? Why? It is a useful thing to do. More than that, it is necessary (but not sufficient). There's a reason why all of pbkdf2, bcrypt and scrypt generate salts if you leave them to their own devices. > See: http://codahale.com/how-to-safely-store-a-password/ for details. You completely misunderstand the article.

It's implicitly understood by everyone who cares about this topic that salting is intrinsic to KDFs. I.E. by the time you've read through, and understood http://codahale.com/how-to-safely-store-a-password/, you understand why "salting" your password gains you nothing, because rainbow tables are no longer particularly relevant to cracking passwords. And yes, while there is salting inherent to KDFs, that's not the major feature of them, but an assumed implementation detail.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#72

Post by wisty »

omra wrote: post #70
estel wrote: post #62

Earlier quoted context omitted.

It's perfectly possible to use md5 to hash a password in Javascript before transmitting it by HTTP. There isn't a huge security benefit to doing so, however.

Only doing that won't help. You might as well be transmitting the password, since someone can just copy the hash and then it would be equivalent to having the password. (Also known as a Pass the Hash attack, http://en.wikipedia.org/wiki/Pass_the_hash ).

Each website could have a salt. The issue is, if it's not a secure connection, it's vulnerable to hijacks.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#73

Post by eli »

makmanalp wrote: post #63

Nice to see computer professionals practice what they preach, both in terms of writing systems that don't store plaintext passwords and using passwords that don't suck.'

The most common password in a giant list of passwords is going to suck sort of by definition.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#74

Post by pbhjpbhj »

masklinn wrote: post #66
pbhjpbhj wrote: post #55

Earlier quoted context omitted.

> It's just about as bad as plaintext. // Hyperbole is just about as bad as murder.

> Hyperbole is just about as bad as murder. It's not hyperbole, a rainbow table will give you instant plaintext for 95% of your passwords. And even if you don't want to use one, an off-the-shelf high-end graphic card (~$500) can compute 10 billion md5 hashes per second, plug that in a not-completely-retarded brute-forcer (jack the ripper, oclhashcat) and you've got pretty much the whole database as plaintext in hours…

Really?

155a7a01308fa0807f722c5984bd91fb

---

I find "high-end graphic card (~$500) can compute 10 billion md5 hashes per second" a bit unbelievable [but that's progress for ya]. So that's roughly all possible alphanum characters of stringlen 6, each second.

So if my calculation is correct (assuming 60 alphanum chars randomly chosen) that's only 7000 years to calculate all 12 char strings?

Yes I realise that md5'ed password strings aren't random nor usually particularly long. Just saying.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#75

Post by CamperBob2 »

OT, but why in God's name do some people/countries feel it appropriate to use periods rather than commas as a thousands separator?

Do these people just want to cause industrial disasters, medical errors, zombie uprisings, and lost planetary probes?

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#76

Post by nathan_long »

e2e8 wrote: post #51
ghshephard wrote: post #48

Earlier quoted context omitted.

One of these days we will shut down the "Salting password hashes is a useful thing to do." meme from 1994. See: http://codahale.com/how-to-safely-store-a-password/ for details.

Of course a salt will not make a single password harder to attack. A salt will however force you to attack passwords "one at a time" by making precomputed hashes useless.

Yes, but you can attack them one at a time at astonishing speed these days.

Which is why you need to not use a hashing algorithm designed to be fast, like SHA, but one designed to be slow, like bcrypt.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#77

Post by batista »

ZoFreX wrote: post #46
0003 wrote: post #43

Earlier quoted context omitted.

I am not too well-versed in this sphere, but I would also require salting passwords when hashing. It obviously won't help if your database is compromised, but will protect your users (and your database) against the effects of leaks such as these.

> It obviously won't help if your database is compromised Good news, everyone: it will!

No, it won't. They can just write a new password + salt in the db and get in as that user.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#78

Post by nathan_long »

wesley wrote: post #16
engtech wrote: post #12

I think it's time for web browsers to step up and start showing a visual indication for websites that store passwords in plaintext.

How would a browser ever know this?

Of course the browser can't know this. But one clue for the user is if there is a strict length limit.

If you're going to hash my password to 16 characters anyway, why can't I type in 20? But if you're going to store it as plaintext, you need to limit what I input.

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#79

Post by pserwylo »

jimhefferon wrote: post #53
kree10 wrote: post #52

Earlier quoted context omitted.

I'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?

How do you dir on http?

WebDAV [0]

If Microsoft every had of built a decent client into Windows Explorer like MacOSX has (rather than the crufty, half baked one they ran with) then it could have been great. As it turns out, it is only really easy to access it through FTP-like programs (separate from Windows Explorer).

Having said that, we had pretty good experiences with WebDrive [1] allowing us to mount WebDAV directories in Windows. Also, Gnome does a pretty good job on Linux with GVFS [2].

[0] https://en.wikipedia.org/wiki/Webdav [1] http://www.webdrive.com/products/webdrive/index.html [2] https://en.wikipedia.org/wiki/GVFS

Re: Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

#80

Post by makmanalp »

eli wrote: post #73
makmanalp wrote: post #63

Nice to see computer professionals practice what they preach, both in terms of writing systems that don't store plaintext passwords and using passwords that don't suck.'

The most common password in a giant list of passwords is going to suck sort of by definition.

Actually, you're right: only 1% using (1234...) ain't half bad.
Post reply on HN