Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI stole an Instapaper server in an unrelated raid

blog.instapaper.com

Post reply on HN
Print view View original

41–50 of 263 posts

Re: The FBI stole an Instapaper server in an unrelated raid

#41

Post by tptacek »

IgorPartola wrote: post #30
Xk wrote: post #25

Instapaper stores only salted SHA-1 hashes of passwords, so those are relatively safe. -- Obligatory statement on NEVER USING SHA-1 HASHES to make passwords "safe". Any normal person can brute force millions of SHA-1 hashes (salted however much you want) per second on a GPU. If the FBI so wanted (although I don't believe they do) I'm sure they could brute force almost every single password in that database. Granted,…

I have been thinking about switching everything to bcrypt, but there is definitely way too much confusion about bcrypt vs scrypt, how many rounds to set for bcrypt, etc. What is the definitive source for figuring out what the new standard should be? Does anyone have any links to something that's peer-reviewed and approved for use by someone with enough authority to do so?

No there isn't. You only think that because when geeks discuss anything that involves one or more knobs, a huge debate must necessarily ensue about the proper values of those knobs.

Just use the bcrypt defaults. You will be fine. You will in particular be so much better off than salted SHA-1 that this topic will be mooted. Later on, maybe in 5-10 years, you can re-engage with the debate about what a good cost factor for bcrypt will be in 2020.

Re: The FBI stole an Instapaper server in an unrelated raid

#43

Post by 5l »

cheez wrote: post #31
Xk wrote: post #25

Instapaper stores only salted SHA-1 hashes of passwords, so those are relatively safe. -- Obligatory statement on NEVER USING SHA-1 HASHES to make passwords "safe". Any normal person can brute force millions of SHA-1 hashes (salted however much you want) per second on a GPU. If the FBI so wanted (although I don't believe they do) I'm sure they could brute force almost every single password in that database. Granted,…

Can you describe why it's better?

He already did:

"Any normal person can brute force millions of SHA-1 hashes (salted however much you want) per second on a GPU."

This is not true of bcrypt.

Re: The FBI stole an Instapaper server in an unrelated raid

#44

Post by tptacek »

cheez wrote: post #31
Xk wrote: post #25

Instapaper stores only salted SHA-1 hashes of passwords, so those are relatively safe. -- Obligatory statement on NEVER USING SHA-1 HASHES to make passwords "safe". Any normal person can brute force millions of SHA-1 hashes (salted however much you want) per second on a GPU. If the FBI so wanted (although I don't believe they do) I'm sure they could brute force almost every single password in that database. Granted,…

Can you describe why it's better?

http://codahale.com/how-to-safely-store-a-password/

(Be prepared for your comment score to visit the grey depths if you attempt to relitigate Coda's blog post here and don't know exactly what you're talking about.)

Re: The FBI stole an Instapaper server in an unrelated raid

#46

Post by kijinbear »

imrehg wrote: post #21
nbpoole wrote: post #4

So, the FBI has a copy of Instapaper's complete database and a copy of their website code. The database includes: - Salted SHA-1 hashed passwords for Instapaper - Encrypted passwords for linked Pinboard accounts (with the encryption key stored in the website code) - OAuth tokens for linked Facebook/Twitter/Tumblr accounts (and presumably also the secret keys used by Instapaper to use those tokens). That's (potentiall…

As a real practical question out of curiosity: how would you design their system differently so unauthorized people having only your hard drives couldn't get any data at all?

Full-disk encryption. You enter the key whenever the system needs to be rebooted. I know at least one company that does this with all of their US-hosted servers.

Re: The FBI stole an Instapaper server in an unrelated raid

#47

Post by 16BitTons »

mrcharles wrote: post #2

All the more reason for data havens to exist. Run your server from a country where the police can't just take it with impunity.

Do you have any suggestions on safe countries? As far as I can tell, the USA is still has the best mixture of freedom and protection available.

Re: The FBI stole an Instapaper server in an unrelated raid

#48

Post by Astrohacker »

cheez wrote: post #38
Astrohacker wrote: post #16

I think it may be prudent to begin encrypting all data on disk that can reasonably be encrypted while being able to set up the server remotely so that no one can just snatch your server and get all your data. This could work by encrypting your database in a truecrypt volume that must be mounted by entering the password. Thus, the data is only ever saved on disk in encrypted form, and the key to access the data is not…

I don't think this is reasonable. If you lose power, the the volume is toast as I understand it.

Obviously you should back it up, like you would be doing anyway.

Re: The FBI stole an Instapaper server in an unrelated raid

#49

Post by discover »

pavel_lishin wrote: post #24
imrehg wrote: post #21

Earlier quoted context omitted.

As a real practical question out of curiosity: how would you design their system differently so unauthorized people having only your hard drives couldn't get any data at all?

You could always hash the e-mails, although this would make resetting your password impossible. How much data do Facebook's OAuth tokens contain? By looking at one, can you tell that it's linked to Pavel Lishin's account?

Would splitting the data in half work?

I mean literally cutting the data sent into two pieces and each piece entering a different database server in a different country. Then, when requested, pulling both pieces and sending them to users who patch them together with client side script...?

Post reply on HN