Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I mean, why not tell everyone our password hashes?

theobsidiantower.com

Post reply on HN
Print view View original

31–40 of 167 posts

Re: I mean, why not tell everyone our password hashes?

#31

Post by patmcc »

kogepathic wrote: post #9
lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

> make all password databases public, in an encrypted form That is a terrible idea because agencies like the NSA or GCHQ with unfathomable resources and techniques will crack them and never tell anyone. Then you'll have a compromised account, the provider won't know, the user won't know. Then the agency would be able to compromise the account a publish whatever they wanted as that identity. Given there are tricks to…

>>That is a terrible idea because agencies like the NSA or GCHQ with unfathomable resources and techniques will crack them and never tell anyone.

As opposed to the current situation where they can just get the info from Facebook/Google/etc. directly? At this point you may as well assume state actors have access to anything you put on the internet.

Re: I mean, why not tell everyone our password hashes?

#32

Post by recursive »

saulrh wrote: post #19
lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

That's what I thought when I read the title. There's probably some reason it wouldn't work. Dictionary attacks are an obvious possibility; if your password is "password" the only thing you're depending on is nobody being able to get at the hashes. It might also expose password reuse, though nonces/salts might solve that. Hrm. This smells a bit like public crypto - public database of public keys (hashes), on login you…

If you're using a keyed hash, then dictionary attacks can't be parallelized.

Re: I mean, why not tell everyone our password hashes?

#34

Post by divbit »

prostoalex wrote: post #3
lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

Make it blockchain-based, and you'll likely have some VC funding by tomorrow morning.

wait ...

Re: I mean, why not tell everyone our password hashes?

#35

Post by ficklepickle »

orblivion wrote: post #27
Glyptodon wrote: post #23

Earlier quoted context omitted.

Isn't that more or less what blockchain-based encrypted storage is? I feel like I saw an HN post on something like that within the last couple months.

Isn't that more of public key crypto? So the secret isn't just a password, but also a key. I think it'd be a lot harder to crack. Really it points to the idea that we should be moving in that direction for auth. Here's one project I've heard about: https://www.grc.com/sqrl/sqrl.htm

SQRL ftw! It's gonna take off any day now. That guy is prolific!

Seriously though, that's the first un-ironic reference to SQRL that I've ever seen.

Re: I mean, why not tell everyone our password hashes?

#36

Post by Ajedi32 »

ceejayoz wrote: post #22
eveningcoffee wrote: post #8

Because your password is part of your identity and is actually used to cross check during identity matching.

Leaving aside the fact that changing my password doesn't mean I have a new identity, having the hash $2y$10$/Aglzm2zpHO7m1dIv5vSp.GHPUd1D8uODn/jtBv3gpe8yS5e/D9PW doesn't tell you my password is "tinkerbell".

If your password is "tinkerbell", even an attacker with very few resources can probably crack the hash for it in seconds on their desktop PC.

Re: I mean, why not tell everyone our password hashes?

#37

Post by cestith »

developer2 wrote: post #18

One reason: you'd be surprised how many companies allow entering the hash as an alternative password to login to customers' accounts in production. Lazy method for customer support teams who don't have support tools to access customer information. Also frequently done to allow developers to debug problems on a customer's account when a bug cannot be reproduced elsewhere. If such a company's database of hashed passwor…

What would it take to get you to name and shame? That whistle pretty likely needs to be blown on the one that didn't agree to abandon such a policy.

Re: I mean, why not tell everyone our password hashes?

#38

Post by ceejayoz »

Ajedi32 wrote: post #36
ceejayoz wrote: post #22

Earlier quoted context omitted.

Leaving aside the fact that changing my password doesn't mean I have a new identity, having the hash $2y$10$/Aglzm2zpHO7m1dIv5vSp.GHPUd1D8uODn/jtBv3gpe8yS5e/D9PW doesn't tell you my password is "tinkerbell".

If your password is "tinkerbell", even an attacker with very few resources can probably crack the hash for it in seconds on their desktop PC.

My password is not "tinkerbell". It serves as an example.

My real passwords look a lot more like the hash.

Re: I mean, why not tell everyone our password hashes?

#39

Post by CiPHPerCoder »

lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

Instead of password hashes, why don't we just use Argon2id as a KDF to produce an Ed25519 keypair, and then publish the (salt, memcost, opscost, Ed25519 public key)?

I can throw this into a structure indistinguishable from a blockchain if any VCs want to invest ;)

Re: I mean, why not tell everyone our password hashes?

#40

Post by dhimes »

developer2 wrote: post #18

One reason: you'd be surprised how many companies allow entering the hash as an alternative password to login to customers' accounts in production. Lazy method for customer support teams who don't have support tools to access customer information. Also frequently done to allow developers to debug problems on a customer's account when a bug cannot be reproduced elsewhere. If such a company's database of hashed passwor…

I....have no words. Effectively clear-text password storage. That should be criminal by now.
Post reply on HN