Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WTF is a KDF?

blog.dataparty.xyz

Post reply on HN
Print view View original

31–40 of 98 posts

Re: WTF is a KDF?

#31

Post by [deleted] »

Gasp0de wrote: post #21
WastingMyTime89 wrote: post #10

Earlier quoted context omitted.

Multiple possible scenarios: - He actually gave his password himself as part of a deal with the police which includes this as a cover up. - The police got his password through another mean they don’t want to disclose and are using this as a cover up. - They really want a list of his contacts and what they were discussing because they are scared than one of them could be tempted to do more than burn a few cars. - Fran…

Bitlocker also saves encryption backup keys in the Microsoft cloud where they can probably subpoenad? Then they might have found the password saved on the windows PC somewhere.

[deleted]

Re: WTF is a KDF?

#32

Post by mr_mitm »

jeroenhd wrote: post #28
mr_mitm wrote: post #13

It really annoys me how everyone takes that statement that a 20 character password has been cracked at face value. If it was randomly generated, it is physically impossible to crack even if it was hashed with MD5. It's also unlikely that somebody memorized 20 random characters. It is much more likely that the passphrase was weak because it's the title of a Wikipedia article or contained in some public word list. Also…

Until we know his password, we can't know for certain. "Fuck the police!2023" fits the description of the password but it's hardly unguessable. All we know is the authorities gained access to his drive's key. We probably won't find out how they did it until his trial starts.

Well, we also know they didn't crack a random 20 character password. But some people appear to be panicking as if they did.

Re: WTF is a KDF?

#33

Post by dist-epoch »

t0mas88 wrote: post #9
wodenokoto wrote: post #2

10.000 cloud GPUs running for a month is a lot of money. What was on that hard drive?

Even with the smallest instance types that's around 8 million in compute cost. Doesn't sound like something you would spend on a small crime?

Encrypting something well is so easy. If your encryption scheme fails at 8 million in compute cost something is horribly wrong.

Re: WTF is a KDF?

#34

Post by lapinot »

mr_mitm wrote: post #13

It really annoys me how everyone takes that statement that a 20 character password has been cracked at face value. If it was randomly generated, it is physically impossible to crack even if it was hashed with MD5. It's also unlikely that somebody memorized 20 random characters. It is much more likely that the passphrase was weak because it's the title of a Wikipedia article or contained in some public word list. Also…

I agree with taking this with a grain of salt, but i'm not sure how "this clearly hints at an evil maid attack". At this point anything is pure speculation: evil maid or other pre-seizure compromise, some amount of password guessing, exploit in some of the software, secret extraction from hardware, ...

Re: WTF is a KDF?

#35

Post by Avery3R »

dist-epoch wrote: post #12

Compared to Windows+Bitlocker, using full disk encryption on Ubuntu (the most user friendly distro) is bizarrely difficult. By default the boot partition is not encrypted (so evil maid attacks are easier) and the KDF iteration counts are way too low, as can be seen here. When I setup FDE with LUKS on my Ubuntu laptop I had to go the manual route since I noticed that the default iteration counts don't make any sense,…

Not exactly sure how the desktop Linux boot process is structured, but on windows with bitlocker the boot partition isn't encrypted either. UEFI has to be able to load a boot manager somehow, and unless you're going to splice in a DXE driver to your mobo's fw, which has the risk of bricking, to decrypt a partition, then you're always going to need a cleartext partition somewhere.

On windows the default way it's set up when you have a TPM though is that it locks the decryption keys against a hash of all of the code that has run during the boot process.

Re: WTF is a KDF?

#36

Post by dist-epoch »

Gasp0de wrote: post #22

I think the most likely situation is this: Bitlocker can save backup keys in the cloud where they can probably be subpoenad by the police. If the victim used a password manager without encryption (e.g. browser) and used or saved the same password somewhere else, they might have gotten it this way.

That's not true, Bitlocker offers the option to save the encryption keys. It's your choice and it's clearly labeled: https://www.top-password.com/blog/wp-content/uploads/2018/10...

Besides, the user also had a Windows laptop encrypted with Bitlocker, and the police failed to crack that one (see top comment).

Re: WTF is a KDF?

#37

Post by dist-epoch »

hh3k0 wrote: post #24
Gasp0de wrote: post #22

I think the most likely situation is this: Bitlocker can save backup keys in the cloud where they can probably be subpoenad by the police. If the victim used a password manager without encryption (e.g. browser) and used or saved the same password somewhere else, they might have gotten it this way.

I might be wrong, but something tells me that people who use LUKS to encrypt a hard drive would not use the password in question for an online service.

People are dumber than you think.

Remember all the mistakes DPR did and commenters were like "a criminal mastermind creating the Amazon of drugs couldn't have possibly asked on StackOverflow using his real identity how to build that".

Re: WTF is a KDF?

#38

Post by Aeolun »

mr_mitm wrote: post #32
jeroenhd wrote: post #28

Earlier quoted context omitted.

Until we know his password, we can't know for certain. "Fuck the police!2023" fits the description of the password but it's hardly unguessable. All we know is the authorities gained access to his drive's key. We probably won't find out how they did it until his trial starts.

Well, we also know they didn't crack a random 20 character password. But some people appear to be panicking as if they did.

You know this because you think it is mathematically impossible?

Re: WTF is a KDF?

#39

Post by rhplus »

mr_mitm wrote: post #13

It really annoys me how everyone takes that statement that a 20 character password has been cracked at face value. If it was randomly generated, it is physically impossible to crack even if it was hashed with MD5. It's also unlikely that somebody memorized 20 random characters. It is much more likely that the passphrase was weak because it's the title of a Wikipedia article or contained in some public word list. Also…

He says his BitLocker drive was on a work computer. If it was managed through Active Directory then those key may have been recoverable through his employer.

https://learn.microsoft.com/en-us/windows/security/informati...

Post reply on HN