The FBI stole an Instapaper server in an unrelated raid • Hacker News Board

Re: The FBI stole an Instapaper server in an unrelated raid

#181

Post by derrickpetzold » Thu, Jun 23, 2011, 9:59 PM UTC

Xk wrote: post #171

derrickpetzold wrote: post #169

Earlier quoted context omitted.

> So what? Just because other people don't do it doesn't mean you don't have to also. Fortunately for us, there are a lot of startup founders here who might read this and learn something. Yes I hope there are. > I disagree. I think most people use SHA-1 because they know better than to store plaintext passwords. What they don't know is that it's terribly broken. SHA-1 is the default on django and its easy to break th…

> The real solution is site security not password security. That does not imply you don't worry about it though -- it's defense in depth. In the same way sometimes you'll need to go through two sets of doors locked with different keys to access a secured server room (or anything else, for that matter), it's worthwhile to protect everything you can as best you can. > They might as well be using ROT-13 if they are usin…

That is fair enough and all your points were very good. However despite the down votes and everything else I stand by what I said. As a user I doubt most devs are as competent as the ones here and I would never trust a site with a password that I depend on. Do that there would need to be third-party auditing to make sure that they adhere to the standards you described.

I guess what I am really trying to say is that the state of web/Internet security is very poor right now and I don't believe bcrypt is worthy pursuit (sorry I am really not trying to troll). Since Mt.Gox was just hacked my salted password is on pastebin and then someone attempted to break into my gmail account but that will never happen because I use two factor authentication.

Maybe that is the best solution to all of this.

Re: The FBI stole an Instapaper server in an unrelated raid

#182

Post by kragen » Thu, Jun 23, 2011, 10:02 PM UTC

boucher wrote: post #100

kijinbear wrote: post #46

Earlier quoted context omitted.

Full-disk encryption. You enter the key whenever the system needs to be rebooted. I know at least one company that does this with all of their US-hosted servers.

And not servers hosted in other countries? I'd be very curious to hear the thought process behind that decision.

Perhaps all their employees live in the US, so they consider it not worth the trouble to fly someone to Indonesia whenever a server in Jakarta needs rebooting.

Re: The FBI stole an Instapaper server in an unrelated raid

#183

Post by InclinedPlane » Thu, Jun 23, 2011, 10:06 PM UTC

Hawramani wrote: post #93

mwytock wrote: post #67

Earlier quoted context omitted.

I dont understand. If you can use mixed-cased, letters and symbols you have 26 * 2 + 20 = 72 possible characters. 72^8 >> 1e9 It would still take more than 8 days to brute force at 1 billion/sec. And using a longer password (16 chars?) would make this a very long time. Or is there other trick that makes this fast? Or, is it simply that people don't choose random, long passwords?

If my understanding is correct that's not the issue here. Hashes are meant to be one-way functions, the developer can easily check if a user's password matches the hash, but it should be practically impossible to deduce the password from the hash. What the user chose as their password should be irrelevant if using a good hash. [Edit: I stand corrected on the effect of password length.]

Sure, but if you can run through billions of possible hashes per second then it's possible to brute force the "one way" hash by exploring hashes for short passwords.

1 billion passwords per second is 86 trillion passwords per day. If a hacker wanted to gain access to a particular password then it can become trivial to crack with fairly modest resources. The only thing that protects you is a sufficiently complex and long password.

Re: The FBI stole an Instapaper server in an unrelated raid

#184

Post by VladRussian » Thu, Jun 23, 2011, 10:11 PM UTC

bproper wrote: post #138

You think it's a coincidence they nabbed Whitey Bulger this morning, after 16 years on the run? His Instapaper account was probably full of stories about Santa Monica.

i think his Instapaper account was full of stories about Whitey Bulger and his old friends/partners/etc... and this is how they "Big Data"-sifting-found him :)

Re: The FBI stole an Instapaper server in an unrelated raid

#185

Post by pkteison » Thu, Jun 23, 2011, 10:13 PM UTC

dragonsky wrote: post #178

getsat wrote: post #36

Earlier quoted context omitted.

> can brute force millions Modern consumer video cards can do billions per second now. You might as well just store them in plaintext instead of using SHA1/MD5 with or without salting. :/

As they have the Web code base, you must assume that they have the salt to the hashing... If they actually want to get these passwords, all they have to do is generate rainbow tables using SHA1 and the appropriate salt. We're back to relying on the length and bit depth (range of characters) of the passwords you are trying to find.

Salts, done properly, vary per user not per server.

Re: The FBI stole an Instapaper server in an unrelated raid

#186

Post by dspace » Thu, Jun 23, 2011, 10:24 PM UTC

Xk wrote: post #25

Instapaper stores only salted SHA-1 hashes of passwords, so those are relatively safe. -- Obligatory statement on NEVER USING SHA-1 HASHES to make passwords "safe". Any normal person can brute force millions of SHA-1 hashes (salted however much you want) per second on a GPU. If the FBI so wanted (although I don't believe they do) I'm sure they could brute force almost every single password in that database. Granted,…

This is more "crypto nerd imagination", a la the XKCD comic. The FBI doesn't care about the encrypted passwords because it has access to all the content in plaintext. And what else would they need the passwords for? Other accounts on other services? They can just confiscate those servers too, where the content is most likely also in plaintext.

So in this case, where the FBI is involve, using a SHA-1 hash poses no extra security vulnerability.

Re: The FBI stole an Instapaper server in an unrelated raid

#187

Post by smallblacksun » Thu, Jun 23, 2011, 10:30 PM UTC

PatrickTulskie wrote: post #12

yuvadam wrote: post #6

I'm trying to think of an analogy which can explain why this might be reasonable from the FBIs perspective. Suppose you were using a shared storage space (shared servers, or server farm) with several other dudes. One of them is a drug dealer. One day the police/FBI decide to raid the storage space since the drug dealer has been using it to store illegal drugs. Is it not reasonable to consider this collateral damage (…

It seems like either the FBI didn't pay attention to the information given to them by DigitalOne or DigitalOne had poor information about where their servers are located. The picture painted here is that the FBI came in and hastily took a bunch of equipment without making sure they were taking the right stuff. If that is accurate, then it's likely they might have missed a server with data on it that they needed for t…

Or they don't trust that DigitalOne (or some employees of DigitalOne) aren't collaborating with their target.

Re: The FBI stole an Instapaper server in an unrelated raid

#188

Post by gwright » Thu, Jun 23, 2011, 10:53 PM UTC

m0nastic wrote: post #170

yuvadam wrote: post #6

I'm trying to think of an analogy which can explain why this might be reasonable from the FBIs perspective. Suppose you were using a shared storage space (shared servers, or server farm) with several other dudes. One of them is a drug dealer. One day the police/FBI decide to raid the storage space since the drug dealer has been using it to store illegal drugs. Is it not reasonable to consider this collateral damage (…

I can certainly think of scenarios in which this action was reasonable from the FBI perspective. I don't like to be in the position of defending the FBI (my own personal and professional relationship with them is complicated), but I think the following situation is plausible (which isn't to say it's what happened, as we don't know): FBI determines the originating IP address of whatever their investigation is targetti…

Consider an analogy. The FBI gets a valid warrant for the servers belonging to a company with a street address of "101 Main St, Somewhere, DC". The building at 101 Main St. is a multi-tenant, multi-story, office building.

If the FBI seized all the computer equipment in the entire building or even just the computers on the same floor as the targeted company but belonging to other companies who just happen to be physically adjacent to the targeted company, would it seem reasonable?

Re: The FBI stole an Instapaper server in an unrelated raid

#189

Post by eneveu » Thu, Jun 23, 2011, 10:56 PM UTC

davidhollander wrote: post #175

tptacek wrote: post #44

Earlier quoted context omitted.

http://codahale.com/how-to-safely-store-a-password/ (Be prepared for your comment score to visit the grey depths if you attempt to relitigate Coda's blog post here and don't know exactly what you're talking about.)

Why is bcrypt better than simply recursively hashing SHA512 ~2^11 times to produce an equivalent work factor? Assume wall time is held constant at 1 second per password using both methods: is there an entropy loss or weakness associated with recursive hashing that bcrypt avoids?

What you are referring to is called "stretching". It's a lot better than a simple salted hash, but bcrypt would still be better.

I'm no crypto expert, but I think this is due to the way bcrypt was designed, and their use of a pessimized Blowfish cypher. SHA512 was designed for speed, which is the opposite of what you want with a password hashing scheme.

tptacek talks a little about this in this blog post:

http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...

"Bcrypt uses Blowfish instead of MD5. Blowfish is a block cipher with a notoriously expensive setup time. To optimize Blowfish to run much faster, you’d have to contribute a major advance to cryptography. We security practioners are all “betting people”, and we usually like to place our bets on the side that “demands major advances in cryptography”."

Other interesting links: http://stackoverflow.com/questions/3722780/do-any-security-e... http://en.wikipedia.org/wiki/Bcrypt

Re: The FBI stole an Instapaper server in an unrelated raid

#190

Post by jleader » Thu, Jun 23, 2011, 10:57 PM UTC

gte910h wrote: post #161

cma wrote: post #56

Earlier quoted context omitted.

The CIA doesn't even need warrants .

In the US? The CIA can't operate in the US.

The CIA is (more or less) not allowed to operate in the US. Historically, that has not always stopped them.