"Unknown or expired link." - Why? • Hacker News Board

Post by wnight » Fri, Oct 14, 2011, 3:46 AM UTC

Dylan16807 wrote: post #97

wnight wrote: post #96

Earlier quoted context omitted.

It's not a druthers kind of thing. If you need to trust that it hasn't been tampered with you must sign it. And if you don't care you might as well not add authentication because without signing it's just a fancy CRC - ie, totally replicable by an attacker. As cookies and links are sent over TCP there should be vanishingly few errors in transmission - you're far more likely to introduce false positives with buggy cod…

I'm not sure what your argument is. Yes if you want to trust it you have to sign it and make sure you implement all the crypto correctly. But I don't see a need for that here. Also TCP's checksum sucks.

You said "sign or sanity check it", as if you can do whichever you want. But in the area suggested they have vast differences and security implications.

How many corrupted web pages do you see because of CRC failure in TCP?

Post by wnight » Sat, Oct 15, 2011, 1:45 AM UTC

technomancy wrote: post #124

wnight wrote: post #100

Earlier quoted context omitted.

Is that specifically to inconvenience someone who would break in, steal your password list, and crack it offline? If not, what was the design goal? If slowing down web login attempts isn't part of it, why not get a dedicated auth server and offload the crypt stuff onto it? And if it is the goal, you could use CPU-friendly sleeps on the front-end to give increasing delays to the repeated guesser.

> Is that specifically to inconvenience someone who would break in, steal your password list, and crack it offline? Probably: http://codahale.com/how-to-safely-store-a-password/ Hashing functions designed for speed are absolutely the wrong thing for passwords.

Yeah, that's what I'd have thought.

But I don't see the need to do the processing on the web servers.

"Unknown or expired link." - Why?

Re: "Unknown or expired link." - Why?

Re: "Unknown or expired link." - Why?