Hetzner Servers Compromised • Hacker News Board

Re: Hetzner Servers Compromised

#131

Post by Dylan16807 » Fri, Jun 07, 2013, 3:46 PM UTC

andyhmltn wrote: post #129

Dylan16807 wrote: post #120

Earlier quoted context omitted.

Okay, but stealing a backup gets you 21 days of those documents, the same amount you can get from the live system. There is no need to worry about backups in particular.

Correct me if I'm wrong, but if you had a backup from 15 days ago, wouldn't that backup contain documents 21 days prior to it? So in effect: up to 36

The backup will have documents from 36 days ago through 15 days ago: 21 days.

If you're worried about someone stealing your entire backup system then you have bigger issues.

Re: Hetzner Servers Compromised

#132

Post by tomjen3 » Fri, Jun 07, 2013, 6:31 PM UTC

darkarmani wrote: post #54

gommm wrote: post #9

Earlier quoted context omitted.

Just got the email too. I'm quite happy with how clear they are about what happened and how they hash their passwords. Very different from Linode. I just wish that they used bcrypt instead of a salted SHA256 but at least it's salted (and anyway in my case I never reuse passwords so no big deal).

> I just wish that they used bcrypt instead of a salted SHA256 but at least it's salted (and anyway in my case I never reuse passwords so no big deal). If they fall under PCI:DSS, they might not be able to use bcrypt since it isn't an official recommended standard. (I am of course assuming that they mean PBKDF2 when they say salted SHA256.)

Would it matter? I mean all they have to do is encrypt it using the old standard and then encrypt that using bcrypt.

Lawyers "do you use blabla standard to encrypt the data?" You> "yes" - and it is secure.

Re: Hetzner Servers Compromised

#133

Post by darkarmani » Fri, Jun 07, 2013, 8:29 PM UTC

bashinator wrote: post #121

darkarmani wrote: post #54

Earlier quoted context omitted.

> I just wish that they used bcrypt instead of a salted SHA256 but at least it's salted (and anyway in my case I never reuse passwords so no big deal). If they fall under PCI:DSS, they might not be able to use bcrypt since it isn't an official recommended standard. (I am of course assuming that they mean PBKDF2 when they say salted SHA256.)

Could you double hash passwords? First with bcrypt for actual security, and then a second time with SHA256 as a bureaucratic measure?

I have a link above about about using PBDKF2 and bcrypt together http://security.stackexchange.com/questions/11552/would-it-m...

The user Thomas Pornin knows his crypt which is why he has 86k reputation.