Adobe confirms stolen passwords were encrypted, not hashed

Post by antocv » Wed, Nov 06, 2013, 8:03 AM UTC

ReidZB wrote: post #102

antocv wrote: post #74

Earlier quoted context omitted.

Why go through all that when you could use the username or email together with the password to encrypt it with 3DES ECB mode? Those would be unique and users who have same passwords would still have different ciphertexts.

Sorry for my late response. 3DES has a block size of 64 bits, or 8 bytes. Unlike a hash function where the whole input affects the whole output (the strong avalanche criterion and whatnot), in ECB mode encryption, data is only changed on 8-byte block boundaries. So, for example, suppose the user's username was 8 characters, their email was 16 characters, and their password was some more characters. Then if you use 3D…

Wow thanks that was interesting, hadnt thought of that.

Post by alexwright » Sun, Nov 10, 2013, 9:50 PM UTC

FireBeyond wrote: post #110

alexwright wrote: post #91

Earlier quoted context omitted.

A form to enter the sha1 of your email address so they can check against a list of addresses they've already sha1ed? And a form that takes the email for people that don't give a shit or don't know wtf a sha is. Maybe just a .txt of the hashes too, but then no ones coming to your web service I guess.

That makes no sense - they have the plaintext of the email addresses they SHA1, so they can correlate it just fine when you enter it in, too.

But if they don't have your address, ie it wasn't leaked or they're full of shit and never had the list, when you enter the SHA1 you don't give them the address.

Re: Adobe confirms stolen passwords were encrypted, not hashed

Re: Adobe confirms stolen passwords were encrypted, not hashed