Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MDN Database Disclosure

blog.mozilla.org

Post reply on HN
Print view View original

21–30 of 50 posts

Re: MDN Database Disclosure

#21

Post by meowface »

flaviojuvenal wrote: post #19
jvehent wrote: post #13

Earlier quoted context omitted.

It's what django uses, and this site uses django.

Django 1.3 or lower. Django uses PBKDF2 [1] since 1.4 (March 23, 2012) [2]. [1] https://docs.djangoproject.com/en/1.5/topics/auth/passwords/... [2] https://docs.djangoproject.com/en/dev/releases/1.4/

Not to mention it's always been easy to implement even when it wasn't bundled by default.

There is utterly no excuse for storing passwords with anything that's not PBKDF2, bcrypt, or scrypt starting in 2009.

Re: MDN Database Disclosure

#23

Post by TD-Linux »

meowface wrote: post #21
flaviojuvenal wrote: post #19

Earlier quoted context omitted.

Django 1.3 or lower. Django uses PBKDF2 [1] since 1.4 (March 23, 2012) [2]. [1] https://docs.djangoproject.com/en/1.5/topics/auth/passwords/... [2] https://docs.djangoproject.com/en/dev/releases/1.4/

Not to mention it's always been easy to implement even when it wasn't bundled by default. There is utterly no excuse for storing passwords with anything that's not PBKDF2, bcrypt, or scrypt starting in 2009.

Right, they switched over to Persona, which is far better. Unfortunately the old hashes were still left in the DB.

Re: MDN Database Disclosure

#24

Post by Karunamon »

[deleted] wrote: post #22

[deleted]

Christ, it's comments like these that make me glad I don't have to write messages for public consumption at large enterprises. People absolutely hang off of every word in the most absurd fashion..

Re: MDN Database Disclosure

#25

Post by zobzu »

Karunamon wrote: post #24
[deleted] wrote: post #22

[deleted]

Christ, it's comments like these that make me glad I don't have to write messages for public consumption at large enterprises. People absolutely hang off of every word in the most absurd fashion..

I feel like a large-enough amount of people just spend their days finding a reason to be complaining at everything. A word, a look, whatever really.

Whatever one will be doing it will never be good enough for some. They just want to be unhappy about it. They want to blame something, someone. It's cool or something.

Re: MDN Database Disclosure

#26

Post by [deleted] »

jvehent wrote: post #16
billyhoffman wrote: post #8

There is much that could be done to improve this announcement: 1- What does "encrypted, salted passwords" mean? MD5 with a static salt? Holy shit, that's a problem. bcrypt? Less so. I have no context to know how concerned I should be, or any indication of how incompetent, or awesome, Mozilla's existing processes and defenses are. Fail. 2- They talk about a "data sanitization process" failing, but then talk about a "d…

A process failed, and the DB dump that is published to help contributors improve the MDN site got out unsanitized. The sanitization/publication process will be redesigned to include stricter controls. For now, it is shut down. MDN has been using persona for a while now, meaning that most accounts don't have passwords in the database. But older accounts still had the SHA256 salted hash that Django creates. We traced b…

[deleted]

Re: MDN Database Disclosure

#27

Post by jeffbryner »

TD-Linux wrote: post #23
meowface wrote: post #21

Earlier quoted context omitted.

Not to mention it's always been easy to implement even when it wasn't bundled by default. There is utterly no excuse for storing passwords with anything that's not PBKDF2, bcrypt, or scrypt starting in 2009.

Right, they switched over to Persona, which is far better. Unfortunately the old hashes were still left in the DB.

To be clear, the only old hashes were those from folks who haven't used persona to log in.

Re: MDN Database Disclosure

#28

Post by ygjb »

anaphor wrote: post #11
ygjb wrote: post #9

Earlier quoted context omitted.

Sha256+salt. See https://github.com/mozilla/kuma We are still working on the rest.

Why did you decide to use sha256 instead of a kdf like bcrypt or pbkdf2? I'm not attacking you, genuinely curious.

To provide a bit more context, in early 2011 we made a conscious decision to move towards the password storage methods described here : https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines

While we were moving in that direction (upgrading apps, etc) we also launched Persona (BrowserID at the time). Some apps opted to switch to Persona, others opted to upgrade password storage mechanisms.

Re: MDN Database Disclosure

#30

Post by frik »

ygjb wrote: post #9
billyhoffman wrote: post #8

There is much that could be done to improve this announcement: 1- What does "encrypted, salted passwords" mean? MD5 with a static salt? Holy shit, that's a problem. bcrypt? Less so. I have no context to know how concerned I should be, or any indication of how incompetent, or awesome, Mozilla's existing processes and defenses are. Fail. 2- They talk about a "data sanitization process" failing, but then talk about a "d…

Sha256+salt. See https://github.com/mozilla/kuma We are still working on the rest.

Please try also to improve the page load time by using a cache, faster hardware, etc.
Post reply on HN