Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI stole an Instapaper server in an unrelated raid

blog.instapaper.com

Post reply on HN
Print view View original

231–240 of 263 posts

Re: The FBI stole an Instapaper server in an unrelated raid

#231

Post by sunchild »

sliverstorm wrote: post #211
sunchild wrote: post #199

Earlier quoted context omitted.

I wish everyone could use complex, unique, strong passwords all the time, but some use cases just don't support it. For example, I have to type my Apple ID into my iPhone/iPad what seems like every 5 minutes in iOS. Without access to 1password or a similar tool, I just can't use a strong password. Even if I did, I couldn't change it as often as I'd like to. FWIW, I wish I could.

security vs. convenience

My point was that the choice is sometimes not left in the user's direct control. If I thought I could choose an absurdly strong password (e.g., to overcome the shortcomings of the developer's choice of SHA1), I would always do that – except if I'm going to need to enter that password from memory a bunch of times per day.

Re: The FBI stole an Instapaper server in an unrelated raid

#232

Post by tzs »

eneveu wrote: post #189
davidhollander wrote: post #175

Earlier quoted context omitted.

Why is bcrypt better than simply recursively hashing SHA512 ~2^11 times to produce an equivalent work factor? Assume wall time is held constant at 1 second per password using both methods: is there an entropy loss or weakness associated with recursive hashing that bcrypt avoids?

What you are referring to is called "stretching". It's a lot better than a simple salted hash, but bcrypt would still be better. I'm no crypto expert, but I think this is due to the way bcrypt was designed, and their use of a pessimized Blowfish cypher. SHA512 was designed for speed, which is the opposite of what you want with a password hashing scheme. tptacek talks a little about this in this blog post: http://char…

Something doesn't make sense in that blog entry you cite. He says:

   Now let’s re-explain rainbow tables:

   1. take a “dictionary” —- say, of all combinations of alphanumerics
   less than 15 characters

   2. hash all of them

   3. burn the results onto a DVD.

   You now have several hundred billion hash values that you
   can reverse back to text —- a “rainbow table”.
Alphanumeric usually means either 36 or 62 possible characters. Let's take 36. Then there are 36^14 possible 14 character alphanumeric passwords. (He said less than 15, so we should also consider 13 characters, 12 characters, and so on, so this is going to come out a little low since I'm just doing 14 exactly). That's 6.14 x 10^21 possible passwords.

If you could compute 10 billion hashes/second, that would take 20000 years. (41 million years if mixed case alphanumeric is allowed). Could anyone REALLY make a table covering all 14 character or less alphanumerics in 2007, and fit it on DVD?

I believe there were tables for 14 character Windows passwords then, but due to poor design Windows passwords were in effect treated as two 7 character passwords. You just needed tables that covered the hashes of all 7 character passwords, which is a lot more tractable. Could that be what the author was thinking of?

Re: The FBI stole an Instapaper server in an unrelated raid

#233

Post by m0nastic »

protomyth wrote: post #229
m0nastic wrote: post #205

Earlier quoted context omitted.

I'm not sure exactly what you mean, but the Defense Department works with other government agencies and non-governmental agencies; and has for quite a long time. One of these collaborations is responsible for you being able to type that comment and have it be readable by someone on another computer. As to the specifics of the DOD CyberCrime center, it was set up in 98 to offer training/services to other law enforceme…

I was wondering about the interaction and how it fits with the Posse Comitatus Act.

My guess is that it is exempted by the Military Cooperation with Civilian Law Enforcement Agencies Act[1]

[1]http://www.law.cornell.edu/uscode/usc_sup_01_10_10_A_20_I_30...

Re: The FBI stole an Instapaper server in an unrelated raid

#234

Post by Kadin »

engtech wrote: post #226
pkteison wrote: post #185

Earlier quoted context omitted.

Salts, done properly, vary per user not per server.

but I'm assuming that if they have the code base, the plaintext user names (emailaddys) and the salted password, then they would have whatever the per user salt is.

Right, but if the salt varies per user, then you end up doing a bruteforce on each user's password; it's no longer a precomputation attack. There are no "Rainbow tables" in this case.

However, if you find Hale's bcrypt page (http://codahale.com/how-to-safely-store-a-password/) convincing, and I do, salting really doesn't matter because with modern GPUs you can bruteforce a reasonably-sized alphanumeric password, if the hash algorithm is a general-purpose (read: fast) one.

The solution is not salt, the solution is to use a purposely slow hash function.

Re: The FBI stole an Instapaper server in an unrelated raid

#235

Post by Stormbringer »

lwat wrote: post #212
marbletiles wrote: post #168

Earlier quoted context omitted.

Was far happier when he didn't store passwords at all, tbh.

Are you joking?

He probably isn't. I wrote a login system for an ecommerce and b2b site a while ago. Got heavily into the salting/hashing side of things back then. Based on that... I think that most of the people pop-pooing salts in this thread don't know what they're talking about.

This security layer is the only code I've ever written that years later would still cause me to wake up in the middle of the night thinking "oh no! What if an attacker did X, Y and Z??!!"

Note: as far as I know, the security I put on it has never been broken. But it still caused nightmares even so.

Re: The FBI stole an Instapaper server in an unrelated raid

#236

Post by idlewords »

lamnk wrote: post #145
bestes wrote: post #17

I think the OP was unreasonably harsh on DigitalOne (never heard of them let alone have any interests). It is very possible that they are consumed with FBI questioning, gag orders or who knows what else. I would give them a pass for a few days until more detail comes out.

I think so too. He says: I have no idea whether I’ll ever see the server again In this case the host probably doesn't know better than him. According to the NYTimes they are a swiss company, they only rent space and connectivity from the data center. I see people jump up and down accusing their host being a bad host when their websites go down for 10 minutes. The thing is, shit like this happens all the time. Some ye…

The problem with DigitalOne was a complete lack of communication around this event. It was a long time (and a lot of badgering) before any of us learned anything about what had happened. I can sympathize with being busy during a crisis, but total silence for 24+ hours, with no working website, email, status page, or twitter account, is not acceptable.

Re: The FBI stole an Instapaper server in an unrelated raid

#237

Post by idlewords »

brown9-2 wrote: post #106
pavel_lishin wrote: post #22

Earlier quoted context omitted.

Do we know what the warrant stated? If it authorized them to take the rack containing the server they were after, then this is legal, if unfortunate. If the police have a warrant for my apartment, and you happen to leave your backpack and server, your stuff will most likely be confiscated, along with mine, if it interests the police.

No, this does not seem to be public knowledge. For all we know the Instapaper (and pinboard, etc) servers could have been included in the warrant.

There's a FOIA request out for the warrant. I'll be curious to see it.

http://www.muckrock.com/foi/view/united-states-of-america/wa...

Re: The FBI stole an Instapaper server in an unrelated raid

#238

Post by danssig »

esrauch wrote: post #218
kijinbear wrote: post #46

Earlier quoted context omitted.

Full-disk encryption. You enter the key whenever the system needs to be rebooted. I know at least one company that does this with all of their US-hosted servers.

This would only be protection against thieves that steal your harddrives, if the US government had your drives they can legally compel you to divulge your password.

There are systems you can use to defeat this. One password decrypts the drive, another wipes it.

Re: The FBI stole an Instapaper server in an unrelated raid

#239

Post by woadwarrior01 »

angusgr wrote: post #196
ahi wrote: post #158

Earlier quoted context omitted.

https://en.bitcoin.it/wiki/Mining_hardware_comparison Not sure if this is what you were looking for or the particular hash bitcoin uses, but a $110 Radeon 5830 can get you around 250Mhash/s

"Hashes" aren't interchangeable, they're an abstract concept. In this case, the thread is talking about the SHA-1 hash algorithm. AFAIK Bitcoin uses SHA-2 w/256-bit digests. So, actually, in this case the two happen to be related but different - SHA-1 being considered potentially flawed but not (yet) the stronger SHA-2. Also, the Bitcoin block headers that are hashed are (I think) 80 bytes (640 bits) long, salted pas…

Yes, I have 2 6950s, which together average to about 660MH/s on hashkill mining bitcoin, but when I tried MD5, IIRC they averaged to about 3200MH/s. I'd assume SHA1 to be slightly slower, but not much.

Re: The FBI stole an Instapaper server in an unrelated raid

#240

Post by eneveu »

tzs wrote: post #232
eneveu wrote: post #189

Earlier quoted context omitted.

What you are referring to is called "stretching". It's a lot better than a simple salted hash, but bcrypt would still be better. I'm no crypto expert, but I think this is due to the way bcrypt was designed, and their use of a pessimized Blowfish cypher. SHA512 was designed for speed, which is the opposite of what you want with a password hashing scheme. tptacek talks a little about this in this blog post: http://char…

Something doesn't make sense in that blog entry you cite. He says: Now let’s re-explain rainbow tables: 1. take a “dictionary” —- say, of all combinations of alphanumerics less than 15 characters 2. hash all of them 3. burn the results onto a DVD. You now have several hundred billion hash values that you can reverse back to text —- a “rainbow table”. Alphanumeric usually means either 36 or 62 possible characters. Let…

I think Thomas was simplifying rainbow tables in his post, to make it more understandable. In practice, you wouldn't use all combination of alphanumerics. You would use a dictionary. This greatly restricts the search space.

http://en.wikipedia.org/wiki/Rainbow_table http://en.wikipedia.org/wiki/Dictionary_attack

Post reply on HN