Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gab Has Been Breached

troyhunt.com

Post reply on HN
Print view View original

131–140 of 194 posts

Re: Gab Has Been Breached

#131

Post by estreeper »

ALittleLight wrote: post #74

Seems like the author is implying but not directly saying the hashed passwords were not salted. Am I reading that right, and does anyone know if they were salted?

The string output from the bcrypt function always contains a 22-character salt embedded within it, so these are salted. This is placed after an initial algorithm identifier (i.e. $2a$) and an adjustable cost used to generate the output string (i.e. 10$). There's an overview of the structure of the output string here if you're interested: https://en.wikipedia.org/wiki/Bcrypt

However, if your password is "password" or another very common password, then someone can just try those with the embedded salt and still find out that was your password.

Re: Gab Has Been Breached

#133

Post by [deleted] »

bawolff wrote: post #118
refurb wrote: post #108

Earlier quoted context omitted.

Maybe I'm missing some context, but what about that Tweet was disgusting versus just trashy or in poor taste? Compared to some of the crap on Twitter it's pretty tame.

The word disgusting literally means to be in extremely poor taste (e.g. "the rotton food i ate was disgusting")

[deleted]

Re: Gab Has Been Breached

#134

Post by ben_w »

bawolff wrote: post #118
refurb wrote: post #108

Earlier quoted context omitted.

Maybe I'm missing some context, but what about that Tweet was disgusting versus just trashy or in poor taste? Compared to some of the crap on Twitter it's pretty tame.

The word disgusting literally means to be in extremely poor taste (e.g. "the rotton food i ate was disgusting")

FWIW, regardless of the origins, “poor taste” always seemed to be a more minor condemnation than that when I have witnessed it — things from Frankie Boyle’s standup or Trump’s interior design preferences to the UK Queen announcing austerity while wearing (and sitting on) the royal bling; never

Re: Gab Has Been Breached

#135

Post by cycrutchfield »

gfosco wrote: post #89
juicyjuicytemp wrote: post #67

Some bit of gossip about the CTO of Gab, seeing as how I've got a bit of context. (Throwaway, for obvious reasons.) The CTO was never a software engineer. They were a developer advocate so had some interaction with code, but was more of a "talk to developers using things and make sure the requirements were passed along to the dev team" sort of guy, rather than someone that knew his technical details (beyond say, the…

You know pretty much nothing about me, unsurprisingly. I certainly don't need your pity, lol, this last year has been one of the best.

I don't know very many people in this world who would call this past year one of their best. This false bravado barely masking the petulance from being called out publicly is really not a good look for you. Maybe your god-emperor can pull off deflecting his own failures in this manner, but you surely cannot.

Re: Gab Has Been Breached

#136

Post by gfosco »

cycrutchfield wrote: post #135
gfosco wrote: post #89

Earlier quoted context omitted.

You know pretty much nothing about me, unsurprisingly. I certainly don't need your pity, lol, this last year has been one of the best.

I don't know very many people in this world who would call this past year one of their best. This false bravado barely masking the petulance from being called out publicly is really not a good look for you. Maybe your god-emperor can pull off deflecting his own failures in this manner, but you surely cannot.

Is it really unthinkable to you that someone could've had a great past 12 months? I'm guessing you wear two masks.

Re: Gab Has Been Breached

#137

Post by ALittleLight »

estreeper wrote: post #131
ALittleLight wrote: post #74

Seems like the author is implying but not directly saying the hashed passwords were not salted. Am I reading that right, and does anyone know if they were salted?

The string output from the bcrypt function always contains a 22-character salt embedded within it, so these are salted. This is placed after an initial algorithm identifier (i.e. $2a$) and an adjustable cost used to generate the output string (i.e. 10$). There's an overview of the structure of the output string here if you're interested: https://en.wikipedia.org/wiki/Bcrypt However, if your password is "password" or…

Very interesting - thanks.

You'd still have to crack each password individually though, right? i.e. for row 1 I would need to try X passwords from my password dictionary, and for each of the attempts bcrypt the guess with the given salt and check to see if worked, and then repeat that for each row individually, rather than checking every row simultaneously.

Re: Gab Has Been Breached

#138

Post by juicyjuicytemp »

quantified wrote: post #126
juicyjuicytemp wrote: post #67

Some bit of gossip about the CTO of Gab, seeing as how I've got a bit of context. (Throwaway, for obvious reasons.) The CTO was never a software engineer. They were a developer advocate so had some interaction with code, but was more of a "talk to developers using things and make sure the requirements were passed along to the dev team" sort of guy, rather than someone that knew his technical details (beyond say, the…

Not sure I understand the downvotes this seems to have collected...

Brigading would be my guess, but eh. Having the subject pop up to respond is pretty amusing. :P

Re: Gab Has Been Breached

#139

Post by juicyjuicytemp »

gfosco wrote: post #120
juicyjuicytemp wrote: post #115

Earlier quoted context omitted.

For what it's worth, I'm not actually surprised you left Facebook when you did. A solid half year of covid meant that you stopped having to interact with folks, in person, that might've reminded you what real people that disagree with you are like, rather than just the caricatures. If you actually think you're as good as you are, I'd dare you to do the "talk to someone that thinks differently than you". I wouldn't be…

It's odd to me that you think I've insulated myself with only people that think like me. It's like you don't know me at all. I'm literally the person who reached out and had 60 different meetings with all sorts there, and continued to maintain bipartisan group chats. Try to realize that you appear to be the one who thinks I'm a caricature.

> I'm literally the person who reached out and had 60 different meetings with all sorts there,

Yup, and I commended you for it. However, that was in 2017. I don't know how carefully you read my original comment, but it can be summarized up as "Fosco started out great, but he's been slowly getting worse". :)

> and continued to maintain bipartisan group chats.

I'd ask you to poll the folks there about how representative of the political spectrum the folks in those chats think they are and if they think any of the parts of the political spectrum are missing from those chats.

Re: Gab Has Been Breached

#140

Post by cycrutchfield »

gfosco wrote: post #136
cycrutchfield wrote: post #135

Earlier quoted context omitted.

I don't know very many people in this world who would call this past year one of their best. This false bravado barely masking the petulance from being called out publicly is really not a good look for you. Maybe your god-emperor can pull off deflecting his own failures in this manner, but you surely cannot.

Is it really unthinkable to you that someone could've had a great past 12 months? I'm guessing you wear two masks.

Better to wear two masks than the one you're wearing: https://i.redd.it/5yso2h5m2jz41.png
Post reply on HN