Project Euler Humble Return • Hacker News Board

Re: Project Euler Humble Return

#21

Post by a_t48 » Fri, Aug 07, 2015, 11:25 PM UTC

gherkin0 wrote: post #19

terminado wrote: post #15

Earlier quoted context omitted.

There's really not much rational for capping passwords at anything beneath 256 characters. 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. In reality, even if they were stored as encrypted binary/base64 in a nosql file system of structured data files, 4096 is pretty much the de-facto floor for disk space occupied by non-zero-byte individual files on most…

> 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. They shouldn't be storing passwords at all so storage space should be a non-issue. My 20 meg password should hash down to the same small(er) value as your 15 character one.

When there will be multiple shorter passwords that hash to the same value, is there a point to a 20mb pass?

Re: Project Euler Humble Return

#22

Post by edem » Fri, Aug 07, 2015, 11:27 PM UTC

dang wrote: post #14

goldenkey wrote: post #8

Why is project euler not on github? Yeah..no one's gonna help unless you open-source your project buddy.

That's not nice. It's also plainly false. Lots of people love Project Euler.

Like me. And I would like to help but I know almost nothing about penetration testing. :(

Re: Project Euler Humble Return

#23

Post by h0w412d » Fri, Aug 07, 2015, 11:28 PM UTC

terminado wrote: post #15

krapp wrote: post #12

Earlier quoted context omitted.

Usernames cannot contain more than 32 characters and they may only contain upper/lower case alphanumeric characters (A-Z, a-z, 0-9), dot (.), hyphen (-), and underscore (_). Passwords must contain between 8 and 32 characters. My money is on "ineptly."

There's really not much rational for capping passwords at anything beneath 256 characters. 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. In reality, even if they were stored as encrypted binary/base64 in a nosql file system of structured data files, 4096 is pretty much the de-facto floor for disk space occupied by non-zero-byte individual files on most…

BCrypt has a character limit of 72.

Re: Project Euler Humble Return

#24

Post by austenallred » Fri, Aug 07, 2015, 11:33 PM UTC

edem wrote: post #20

I don't get it why someone would hack project euler.

http://www.hackthissite.org/ lists "hack project euler" as the final challenge

Re: Project Euler Humble Return

#25

Post by 0942v8653 » Fri, Aug 07, 2015, 11:35 PM UTC

gherkin0 wrote: post #19

terminado wrote: post #15

Earlier quoted context omitted.

There's really not much rational for capping passwords at anything beneath 256 characters. 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. In reality, even if they were stored as encrypted binary/base64 in a nosql file system of structured data files, 4096 is pretty much the de-facto floor for disk space occupied by non-zero-byte individual files on most…

> 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. They shouldn't be storing passwords at all so storage space should be a non-issue. My 20 meg password should hash down to the same small(er) value as your 15 character one.

On the other hand, you might not want to be hashing a 20meg password. It is fast on my computer but it's fair to limit at something more reasonable.

    $ python -c 'print "8 bytes\n" * (20 * 1024 * 1024 / 8)' > 20meg.txt; time shasum -a 512 20meg.txt 
    59cb7f88ad8d6229e6d3a74ee422dff57e17f168c6e6fa44ef32c3f07a73a6e455d8b55c1265d5212b9ed5475b6d9364286645200dada59aa16905a9ce748561  20meg.txt

    real	0m0.289s
    user	0m0.284s
    sys	0m0.004s

    $ python -c 'print "8 bytes\n" * (16 / 8)' > 16byte.txt; time shasum -a 512 16byte.txt
    b6043d3a520424d5ec17dc0c23ba3b591d74517e2b9faa0df2d69d13c89a5f372d6dc35f95836687ee05be18433277e1c4b67393eb2771b475d655a832b16654  16byte.txt

    real	0m0.045s
    user	0m0.040s
    sys	0m0.004s

Re: Project Euler Humble Return

#26

Post by revskill » Fri, Aug 07, 2015, 11:41 PM UTC

goldenkey wrote: post #8

Why is project euler not on github? Yeah..no one's gonna help unless you open-source your project buddy.

How to down-vote a comment ?

Re: Project Euler Humble Return

#27

Post by thaumaturgy » Fri, Aug 07, 2015, 11:43 PM UTC

0942v8653 wrote: post #25

gherkin0 wrote: post #19

Earlier quoted context omitted.

> 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. They shouldn't be storing passwords at all so storage space should be a non-issue. My 20 meg password should hash down to the same small(er) value as your 15 character one.

On the other hand, you might not want to be hashing a 20meg password. It is fast on my computer but it's fair to limit at something more reasonable. $ python -c 'print "8 bytes\n" * (20 * 1024 * 1024 / 8)' > 20meg.txt; time shasum -a 512 20meg.txt 59cb7f88ad8d6229e6d3a74ee422dff57e17f168c6e6fa44ef32c3f07a73a6e455d8b55c1265d5212b9ed5475b6d9364286645200dada59aa16905a9ce748561 20meg.txt real 0m0.289s user 0m0.284s sys 0…

Fast password hashing is bad anyway. Slow schemes are better (assuming they come from a thoroughly tested library written by someone that actually knows what they're doing).

Re: Project Euler Humble Return

#28

Post by zajd » Fri, Aug 07, 2015, 11:45 PM UTC

smoyer wrote: post #9

zajd wrote: post #3

It's a shame the maintainer of the site is going to let it fall into obscurity instead of just adopting more modern development practices. edit. Such as allowing people to audit the source of the site as opposed to requesting pentesting.

I didn't down-vote you (yet), but I don't understand how asking for security help is the same as letting the site fall into obscurity. What modern development practices would you suggest? Comments like this (sometimes) go half-way. If there's a point behind it, enumerate the ways you think would improve his practices.

It's less that he's asking for help and more that this has happened multiple times and it's quite clear he should be allowing someone to audit the source code, not just search blindly for attack vectors. It's clear there are issues, it's time to invite some help.

Re: Project Euler Humble Return

#29

Post by civilian » Fri, Aug 07, 2015, 11:46 PM UTC

revskill wrote: post #26

goldenkey wrote: post #8

Why is project euler not on github? Yeah..no one's gonna help unless you open-source your project buddy.

How to down-vote a comment ?

You click the "down" arrow that's below the up arrow. You also need a bunch of karma, like 500 or a 1000.

Re: Project Euler Humble Return

#30

Post by zajd » Fri, Aug 07, 2015, 11:46 PM UTC

dang wrote: post #16

zajd wrote: post #3

It's a shame the maintainer of the site is going to let it fall into obscurity instead of just adopting more modern development practices. edit. Such as allowing people to audit the source of the site as opposed to requesting pentesting.

Please don't post backhanded swipes like this, or outright insults like "This guy is a moron." [1] The idea on HN is to comment civilly and substantively [2], or not at all. 1. https://news.ycombinator.com/item?id=10023513 2. https://news.ycombinator.com/newsguidelines.html

Fair enough, just frustrated with the overwhelming number of "the modern internet is broken!!" posts that have been clogging up the front page lately. That also happened to be one particularly light on content.