311–320 of 596 posts
Earlier quoted context omitted.
Gonna guess that's a bad message for a password length violation or something else. Not that it's much better. Is it so hard to allow 50 character passwords?
if the password is stored properly, (i.e. bcrypt), the number of characters shouldn't matter at all, be it 50 or 5000.
Earlier quoted context omitted.
I'm a total greenhorn when it comes to cryptography, but the difference between these two situations was totally lost on me until I read this comment. When I see, "It's easy to create MD5 collisions," my first thought is, "If you give me a hash, it's easy to find a string that results in an identical hash." If I'm understanding this right, that would be a "preimage attack," and would be bad for all the reasons being…
Most people here don't seem to understand the difference between collision and preimage attacks. So they're overreacting to the fact Yahoo used MD5. Storing unsalted passwords, however, would be a huge mistake, if Yahoo did so as someone here claimed. There are precomputed lookup tables for the unsalted hashes of many, many passwords (both MD5 and more secure hashes) and cracking unsalted passwords is simply a databa…
Earlier quoted context omitted.
Yes, 'offshore' is a race. Every critique is a racism. Coming from said 'offshore' (at least in regards to the US), I see that 'quality' people work remotely for monies comparable to the onsite workers, launch startups, et cetera. If you outsource to the offshore for the costs, guess what, you get lesser quality for the said cost. Nothing racist in that, but I understand your position - a SJW to every household!
race is a bogus concept anyway, "racism" is the everyday term for xenophobia. give it a break.
Offshore is not a race. That's just xenophobia.
Earlier quoted context omitted.
Some states like CA have a legal requirement to notify in the event of a breach, so hiding this event is illegal.
The article is from Yahoo, it's a notification from Yahoo, announced by their head of security. They're not hiding the event.
Earlier quoted context omitted.
Gonna guess that's a bad message for a password length violation or something else. Not that it's much better. Is it so hard to allow 50 character passwords?
if the password is stored properly, (i.e. bcrypt), the number of characters shouldn't matter at all, be it 50 or 5000.
Earlier quoted context omitted.
If it's a password so long and complex it wouldn't be in any rainbow table computable in reasonable time. While MD5 can be computed quickly, there is still a limit to how many you can compute -- and there are an infinite number of possible passwords if they aren't length limited.
Rainbow tables are attacks against secure algorithms. MD5 is recognised as an insecure algorithm: given a known hash, there are multiple possible passwords that would resolve to the same hash, therefore appearing to be the correct password. With MD5, it's not necessary to compute an infinite number of possible passwords, and it is possible that, given a particular hash, a collision can be found within a reasonable ti…
This isn't the reason that MD5 is weaker than other algorithms.
Earlier quoted context omitted.
if the password is stored properly, (i.e. bcrypt), the number of characters shouldn't matter at all, be it 50 or 5000.
If the password is stored properly, (i.e. bcrypt) then there does need to be some length limit or it becomes too easy to DoS a service by sending it hundreds of megabytes of password to bcrypt. There's no reason for that length limit to be less than 100 characters though.
To upload 100s or even more than a few megs you need a multipart message, a password form won't accept MP http requests.
Earlier quoted context omitted.
Gonna guess that's a bad message for a password length violation or something else. Not that it's much better. Is it so hard to allow 50 character passwords?
if the password is stored properly, (i.e. bcrypt), the number of characters shouldn't matter at all, be it 50 or 5000.
In the interests of hewing closest to cryptographic reality, I design not to allow a password longer than the algorithm can usefully use.
Earlier quoted context omitted.
In this case an attacker isn't looking for a collision (which would mean creating two passwords with the same hash, and what hash that is doesn't matter). The attacker needs a password with a specific hash, and the best reported attack for that is around 2^128.
Agreed, that the best reported rainbow-table attack on MD5 is 2^128 (i.e. the complete range of possible MD5 hashes). Personally, I'm willing to chance that my password will be discovered via a brute-force attack within the next 0.65 billion billion years [1] [1] http://bitcoin.stackexchange.com/questions/2847/how-long-wou...
A new preimage attack could be discovered - or might already have been, secretly.