Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter • Hacker News Board

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#31

Post by Locke1689 » Sun, Jan 09, 2011, 12:09 AM UTC

tptacek wrote: post #25

Locke1689 wrote: post #18

Earlier quoted context omitted.

That's fair but I'm using OpenID (and developing a new Django OpenID authentication system) partially because I'm reasonably sure I've kept up with crypto best practices to store passwords safely but I'm also reasonably sure that most developers haven't . I'd rather people just use OpenID rather then fuck everything up.

Best practices for secure password storage really --- and I'm not being hyperbolic --- haven't changed much since the '90s. Poul Henning-Kamp wrote the FreeBSD MD5-based password hash and captured the main problem with secure password storage on his first try. The requirement here is not really evolving. The reason people (mostly me, admittedly) raise such a stink about this is that using SHA1 or MD5 directly to crea…

Sure, but I still think you overestimate the general security knowledge of web developers. I wouldn't be terribly surprised to see that most people aren't even hashing the passwords.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#32

Post by tptacek » Sun, Jan 09, 2011, 12:16 AM UTC

Locke1689 wrote: post #31

tptacek wrote: post #25

Earlier quoted context omitted.

Best practices for secure password storage really --- and I'm not being hyperbolic --- haven't changed much since the '90s. Poul Henning-Kamp wrote the FreeBSD MD5-based password hash and captured the main problem with secure password storage on his first try. The requirement here is not really evolving. The reason people (mostly me, admittedly) raise such a stink about this is that using SHA1 or MD5 directly to crea…

Sure, but I still think you overestimate the general security knowledge of web developers. I wouldn't be terribly surprised to see that most people aren't even hashing the passwords.

I take your point: OpenID is something they might actually want to do, especially if it's promoted heavily.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#33

Post by Xk » Sun, Jan 09, 2011, 5:07 AM UTC

jacobolus wrote: post #28

Reformatted and put in forward order: * * * Zed Shaw & Dan Kaminsky Talk about autho.me Dan Kaminksy ( http://en.wikipedia.org/wiki/Dan_Kaminsky ) and Zed Shaw ( http://en.wikipedia.org/wiki/Zed_Shaw ) chat on Twitter about Shaw's new project http://autho.me Z: In my research on "Javascript Crypto Not Secure" I can't find any exploits of the actual math available in javascript. Anyone got link? D: You're probably goi…

> Z: Oh yeah, totally. http://autho.me/start.html. BREAK IT MY BROTHER! I'll buy you a beer for each flaw you find. :-)

http://news.ycombinator.com/item?id=2035617

I'm not yet of the legal drinking age, so I'll pass on the beer.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#34

Post by krainboltgreene » Sun, Jan 09, 2011, 7:02 AM UTC

tptacek wrote: post #14

ihodes wrote: post #13

Earlier quoted context omitted.

You missed that you're not going to be using the same password for each website. Autho.me isn't a spin-off of OpenID, it's basically outsourcing signing-in/password "storing" for websites that don't want to risk fucking it up. The point isn't to have a single ID to use across all websites.

If you are worried about fucking up password storage (and, good for you), it's not that hard. Read: http://codahale.com/how-to-safely-store-a-password/ Not that it's Zed's fault that this is true†, but it's actually harder to safely host something like AUTHO.ME on a website than it is to simply use a reasonable hashing algorithm. † I both believe this and also have to say it to avoid a sharks/jets rumble with him on…

Autho.me and Vault-13 look to solve three issues:

1. Remove the worry of security. Look at 90% of the security/password questions on SO/reddit. Almost all the answers are SHA1+Salt.

2. Remove the resource requirement from development. Writing these things takes time and research if you don't know the proper solution. These services can reduce it to an install or a copy and paste.

3. Removing needless database structure. We manage the database (including any sort of movement or upgrading), the customer doesn't have to.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#35

Post by mfukar » Sun, Jan 09, 2011, 7:33 AM UTC

zedshaw wrote: post #24

gst wrote: post #10

I still don't get the reason why I should use autho.me over OpenID. With OpenID the site to which I want to login redirects me to my OpenID provider. So the advantages are: - I login on the site of my OpenID provider and the site to which I want to login does not learn my password. - I can check the identity of the OpenID provider before disclosing my password (e.g., by checking the SSL certificate). - The OpenID pro…

This comes down to the contention between, using the terms I'm going with, a Customer and a User. Let's say you're logging into soawesome.com as a User of soawesome.com. That makes soawesome.com the "Customer", and you the User. Just to setup some terms. Also, let's say I'm not picking on OpenID but really any of the "redirect based" auth methods that transfer ownership of users to a 3rd party. The difference in desi…

Query, with regard to paragraph #3: If someone can hack soawesome.com while the User is logged in, does she unconditionally gain the User's login credentials on soawesome.com, ie. can she impersonate the User on soawesome.com from that point on?

[edit]PS. Also, on a different subject, just to see if I got autho.me straight: in the SRP protocol description [1], autho.me would be Steve, correct?

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#36

Post by mfukar » Sun, Jan 09, 2011, 7:36 AM UTC

dotBen wrote: post #30

The only thing I took away from this is proof that Twitter is not a conversation tool, no matter how much people say otherwise. Unless your conversations never have more than a handful of exchanges. Must have been hell for those who follow both parties and thus would have triggered Twitter's mechanism which ensures you receive tweets that begin with the @name of another user you follow.

I follow all three (tptacek, @dakami, zedshaw), and at times I want to kill myself for using Twitter.

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#37

Post by marshray » Sun, Jan 09, 2011, 11:12 AM UTC

Does Javascript have so much as a secure memory overwrite function? Documented constant-time operations?

If not, how is it that knowledgeable professionals and hackers are seemingly tossing around the term "Javascript Crypto" with a straight face?

Re: Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

#38

Post by tptacek » Mon, Jan 10, 2011, 3:15 AM UTC

marshray wrote: post #37

Does Javascript have so much as a secure memory overwrite function? Documented constant-time operations? If not, how is it that knowledgeable professionals and hackers are seemingly tossing around the term "Javascript Crypto" with a straight face?

No. No. I don't know. They should stop, Marsh.