321–330 of 665 posts
If anyone is curious, the equivalent in modern notation is “1. d4!”. Moving the pawn in front of the queen forward by two spaces. The exclamation point indicates that the annotater believes it to be a particularly strong move (describing a standard move from opening theory that way is a bit tongue-in-cheek).
Earlier quoted context omitted.
It doesn't seem like it should be obviously true to me. If the hash algorithm was rot13 it would be pretty easy to determine the password from the hash regardless of the strength of the password
Yep, you need both the input and hash to be strong. A weak hash reveals information about its input, narrowing the search space. In the example case of md5 or rot13, you can use this to compute collisions for a given hash. Also, a hash that is lightning-quick to compute is faster to brute force. That's why bcrypt has a tunable "cost" factor - to make the hashing take longer and make guessing the password slower.
I should've used "strong KDF" rather than "strong hash", a hash can be strong for other purposes, but makes a poor KDF for hashing passwords, such as single-round SHA-256.
In the ideal world, if your password is a random word with 128-bit entropy, no strong KDF is needed, there's no need for PBKDF2, bcrypt, or Argon2, a single round of SHA-256 is sufficient.
> In the example case of md5 or rot13
MD5 still has strong preimage/second-preimage resistance, unlike ROT-13.
But nobody uses random 128-bit strings as passwords, here's how key stretching and cost-factor comes to play.
Earlier quoted context omitted.
I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.
every 90 days is the god pattern
Earlier quoted context omitted.
Much "NSA shit" is also well known. The questionable behavior in this case is getting a guy fired for selecting a politically-incorrect secret passphrase . This is merely one step removed from reading his brain and figuring out he fantasizes about spanking coworkers while having sex with them. (I've done this, and yet we are good friends!) We don't know all the details, maybe that guy actually harassed people, but sc…
> The questionable behavior in this case is getting a guy fired for selecting a politically-incorrect secret passphrase. I think you're being disingenuous. The guy got fired for sexual harassment. The password merely tipped people off as to what was going on. Don't use a weasel word like "politically incorrect" to re-frame the discussion in a way that's both incorrect and more favorable to an emotional reaction in yo…
I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable. (Granted, it doesn't sound like they did anything fancy like throwing a hundred cloud instances at it or something; I'm not saying you should use DES today:) )
Would this suggest that 3DES with a sufficiently long password is still safe for now?
1. Would it be safe to build a password hash like crypt() based on 3DES today?
Maybe, kind of, it depends, don't do this. "Based on" is key here. You'd have to come up with some way to try to use 3DES in this fashion, just as the developers of Unix crypt() used DES. Basically you're trying to build a cryptographic hash out of a primitive that's not really intended for that purpose, you also need to add more salt than the Unix team did back then, and then you need it to run very slowly, preferably on everybody's hardware not just the generic (likely x86-64) general purpose CPU you're using. Lots of people already built _good_ ways to do password hashing in the 21st century, and if none of those are available somehow you should just use PBKDF2 with SHA256 and a nice big iteration count and that'll be tolerable.
2. Oh, I didn't realise, I just meant is 3DES fine for encryption?
You should not do this. The main thing wrong with DES is the key size is too small, which 3DES fixes (effective key size with full 3DES is 112 bits, which is very short today but probably not the biggest hole in whatever security system you're building). But the next biggest thing wrong with it is that it's a block cipher with a small block size, 64-bits. 64-bits is small enough that bad guys may be able to collide your blocks and set fire to everything. To avoid this: Don't use 64-bit block ciphers, go get a real cipher like AES that uses 128-bit blocks. Done. Why are you still here? Could it be secure if you can defuse the collision risk (e.g. you only encipher very small amounts of data)? Sure, but now you're defining the problem to make the choice of primitive look safe, which is always a terrible idea.
I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.
Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…
Now, if the rules were totally secret, you could make it such that each time you used a password, it was no longer valid. That would defeat the keylogger, while still allowing you to remember your 3 special characters. But of course you can't ever assume your rules are secret (security by obscurity and all that).
I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.
Earlier quoted context omitted.
I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.
Because if people don't push back against it, what we get is yet another incarnation of the witch trials. Some people evidently want that, because they're "not a witch" themselves. It's really awful that in some/many cases, accusations of rape or sexual assault or sexual harassment or creepiness end up reducing to one person's word against another, when there's no good objective evidence either way. You should doubt…
Studies bear out that false accusations of sexual misconduct are exceedingly rare. If you go just by the odds, the likelihood is that when someone accuses someone of misconduct, it probably happened.
That doesn't mean you just accept an accusation at face value, but it does hopefully set the stage for you to be sympathetic, and committed to be thorough and to actually listen to what the accuser is saying. You of course do an investigation. You talk to the involved parties. You talk to witnesses, if there are any. Some of these witnesses may not have been present for any of the alleged offenses, but might speak to the involved parties' character. Does the accused act creepy around other people? Is the accuser constantly making up false stories about people?
If it does boil down to taking one person's word against the other, then I don't think the default should be to just separate the people and hope nothing happens again. Just as in a civil law case, part of the determination (both the direction of the judgment itself, as well as the magnitude of any penalties) is based on who is more persuasive about any available evidence, not strictly about whether the evidence alone is more or less damning.
It's not cut and dried. It's not clear. It's fuzzy and muddy. That's unfortunate, but happens to be the reality of dealing with humans.
If anyone is curious, the equivalent in modern notation is “1. d4!”. Moving the pawn in front of the queen forward by two spaces. The exclamation point indicates that the annotater believes it to be a particularly strong move (describing a standard move from opening theory that way is a bit tongue-in-cheek).
What does the p/ part mean? My chess experiences is all after the popularity of descriptive notation...
p : pawn
/ : at
q2 : queen's file, rank 2
- : moves to
q4 : queen's file, rank 4
! : good move!
Earlier quoted context omitted.
Not really. It was well known that passwords were being cracked, and the guy in question was even warned already that his password had been cracked the week before.
Wait, how is it a common / weak password if it has some oddly sexual phrase regarding a specific person? Sounds like its literally just brute-forcing, in which case you're just going to hit random user's passwords.