Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adobe confirms stolen passwords were encrypted, not hashed

csoonline.com

Post reply on HN
Print view View original

21–30 of 112 posts

Re: Adobe confirms stolen passwords were encrypted, not hashed

#21

Post by nitrogen »

tptacek wrote: post #12

the top options being bcrypt, scrypt, PBKDF2, or SHA-2 Thanks, CSO Magazine!

Why is SHA-2 in the list? [Looks like cperciva beat me to it, 0 minutes ago]

Something I've always wondered about SHA and MD5, though: if you feed the output of a hash function into its input enough times, will you eventually reach the original value? Will you have traversed the entire output space of the hash, or will there be multiple closed loops, or perhaps even multiple starting points converging on a single terminal loop?

Re: Adobe confirms stolen passwords were encrypted, not hashed

#22

Post by sb23 »

dorian-graph wrote: post #15
mayneack wrote: post #14

Anyone got a link to where one might check for the presence of their own email in this list?

http://adobe.cynic.al/

Is it ironic that to check if my email is vulnerable i'm typing it in to a website that i'm not sure whether to trust?

Re: Adobe confirms stolen passwords were encrypted, not hashed

#23

Post by smtddr »

nwh wrote: post #6
001sky wrote: post #4

Adobe says that they've followed best practices for password storage and protection for more than a year now... 13 generations of photoshop ...and they're just getting around to this after CS6?

I wouldn't call Photoshop an achievement, it's a hodgepodge of old libraries and bugs at the best of times. Adobe refused to patch a vulnerability in CS5 at one point, telling people to purchase and upgrade to CS6 (US$199) if they wanted to not be vulnerable to malicious code execution. In response to the uproar they eventually backported the patch. [0]: http://www.macworld.com/article/1166779/adobe_will_issue_fre...

If Photoshop, basically industry standard in image-editing software, isn't an achievement... then nothing qualifies as an achievement. And this is coming from someone who prefers GIMP on linux. I would love to produce something even a quarter as popular & usable as Photoshop.

Re: Adobe confirms stolen passwords were encrypted, not hashed

#24

Post by nwh »

smtddr wrote: post #23
nwh wrote: post #6

Earlier quoted context omitted.

I wouldn't call Photoshop an achievement, it's a hodgepodge of old libraries and bugs at the best of times. Adobe refused to patch a vulnerability in CS5 at one point, telling people to purchase and upgrade to CS6 (US$199) if they wanted to not be vulnerable to malicious code execution. In response to the uproar they eventually backported the patch. [0]: http://www.macworld.com/article/1166779/adobe_will_issue_fre...

If Photoshop, basically industry standard in image-editing software, isn't an achievement... then nothing qualifies as an achievement. And this is coming from someone who prefers GIMP on linux. I would love to produce something even a quarter as popular & usable as Photoshop.

It's not. Have a look at what it's users have to put up with on a daily basis.

http://bad-adobe.tumblr.com

Re: Adobe confirms stolen passwords were encrypted, not hashed

#27

Post by tedunangst »

nitrogen wrote: post #21
tptacek wrote: post #12

the top options being bcrypt, scrypt, PBKDF2, or SHA-2 Thanks, CSO Magazine!

Why is SHA-2 in the list? [Looks like cperciva beat me to it, 0 minutes ago] Something I've always wondered about SHA and MD5, though: if you feed the output of a hash function into its input enough times, will you eventually reach the original value? Will you have traversed the entire output space of the hash, or will there be multiple closed loops, or perhaps even multiple starting points converging on a single ter…

There has to be at least one loop (or fixed point that maps to itself). There's only a finite set of outputs, and the input space of strings as long as a hash is at least that large (in theory, some output hashes may not be possible to generate). Ideally you'd have very large, long loops, which implies few collisions.

Re: Adobe confirms stolen passwords were encrypted, not hashed

#28

Post by tedunangst »

nwh wrote: post #24
smtddr wrote: post #23

Earlier quoted context omitted.

If Photoshop, basically industry standard in image-editing software, isn't an achievement... then nothing qualifies as an achievement. And this is coming from someone who prefers GIMP on linux. I would love to produce something even a quarter as popular & usable as Photoshop.

It's not. Have a look at what it's users have to put up with on a daily basis. http://bad-adobe.tumblr.com

[Comment comparing software nobody likes and software nobody uses.]

Re: Adobe confirms stolen passwords were encrypted, not hashed

#29

Post by tedunangst »

discardorama wrote: post #19

Adobe, once again. The gift that keeps on giving. After inflicting Flash on the Internet for 15 years, now this. Has any other company caused as much grief on the Internet as Adobe?

Adobe has only owned Flash for the past 8 years. The first (and I'd say, most relevant) 9 years of infliction were caused by an independent Macromedia.

Re: Adobe confirms stolen passwords were encrypted, not hashed

#30

Post by kevinpet »

tedunangst wrote: post #20
001sky wrote: post #4

Adobe says that they've followed best practices for password storage and protection for more than a year now... 13 generations of photoshop ...and they're just getting around to this after CS6?

I'm curious to hear when exactly people think bcrypt became accepted best practice? And how much of a grace period did people have to switch? Were you incompetently negligent if you didn't use bcrypt by 2003? 2007? 2011? (I ask this as a fairly big fan of bcrypt myself. Somehow I just have the impression that half the peanut gallery comments come from people who literally switched over from md5 hashes yesterday and s…

The issue is not bcrypt vs. some other hash. The issue is hashing vs. reversible encryption.

Unix has been using salted hashed passwords since the 70s. "one-way hash function" is a common phrase in the first edition of Applied Cryptography published in 1994. http://books.google.com/books?q=isbn:0471597562

Post reply on HN