OVH Security Incident • Hacker News Board

Re: OVH Security Incident

#51

Post by gouggoug » Tue, Jul 23, 2013, 2:29 AM UTC

johnchristopher wrote: post #17

seivan wrote: post #16

Earlier quoted context omitted.

Wasn't there a recent thing with their CEO hating Github because of "Githubs agenda of poaching developers" or some shit like that?

Oh yeah: http://www.ovh.com/fr/a1136.interview-github-octave-klaba-ov... Google translate: http://translate.google.com/translate?hl=fr&sl=fr&tl=en&u=ht...

I've always been a huge fan of OVH in my previous company. I had never seen this article. I was planning on moving my company's infrastructure from Rackspace to OVH. Reading this article makes me reconsider my decision.

Note to future CEOs: your opinions matter when it comes to getting/keeping customers. Customers not sharing your opinions are likely to leave, if they can, or not subscribe to your services if they're not already subscribed. Bashing github is certainly the best way to alienate the developer community from OVH. Moreover, stating that the reason was because one of their developer got hired by another company makes me wonder what must be the working conditions at OVH. I had thought one day applying there, I won't think about it anymore.

Re: OVH Security Incident

#52

Post by adamseabrook » Tue, Jul 23, 2013, 2:33 AM UTC

cmer wrote: post #49

adamseabrook wrote: post #46

Earlier quoted context omitted.

We tried a number of hosting companies before settling on OVH including the premium dedicated companies. They do have the occasional hiccup but overall we have been very impressed with the pricing and the support both reactive and proactive. The day we signed up for our 50th server we received a nice personal email from the head of their support in Montreal.

We have over 25 machines with them. How do you cope with having to pay individually for every single machine, every single month? Their billing system is non-sense, unless I'm missing something?

It is annoying but the cost of having someone sit there and click renew for 4 hours once a month is still less than the $35k extra we would have to pay to host elsewhere.

Re: OVH Security Incident

#53

Post by yeukhon » Tue, Jul 23, 2013, 3:24 AM UTC

jlgaddis wrote: post #38

mrb wrote: post #37

"The encryption password is "Salted" and based on SHA-512, to avoid brute-force attacks. It takes a lot of technical means to find the word password clearly" "clearly?" OVH is wrong. Based on this information alone, it is not sufficient to say how costly it is to recover the password. SHA-512 needs to be iterated to make it costly to brute force. For example, a raw SHA-512 hash, even salted, is not iterated and is ea…

If one's password is "password", the choice of hash algorithms and salts is irrelevant anyway.

Yes and no. If you salted a plaintext using any hash algorithm, the biggest advantage is on the population, not an individual password; so yes, it is irrelevant for any single password. If you have comprised a database, and you are interested in a single user, then you can easily recompute months. But if you are interested in compromising a large user population, because you want to find the weakest (like find all the users using 'password' or '123456'), then you have a hard time because with salt you cannot find occurrence. People think salt saves everything, that is not true. It only adds hardness to secure a population, not an individual password (because the salt is appended and stored!). Now when it comes to iteration, sure, adaptive hashes like bcrypt or scrypt can make computation longer. That's all. Using sha512 is still wrong: it's a hash designed for fast hashing, not for securing password. bcrypt is slowly broken. Slowly because workfactor is exponential.

Re: OVH Security Incident

#54

Post by pavs » Tue, Jul 23, 2013, 5:06 AM UTC

Robin_Message wrote: post #13

eli wrote: post #11

Earlier quoted context omitted.

It doesn't matter; you should assume your password is lost. Follow their advice: "we advise you to change the password for your user name."

It matters a great deal (well, not to me, I don't use the service). Password reuse is common, and the way to fix that is good quality password hashing. If I used OVH, I'd need to change my password everywhere now. If I used someone competent (i.e. they still have bugs but they use bcrypt), they'd have lost: $2a$10$NkYCXBjWeVP0rJUlfl0VL.d66EvJjbVUA/YEsmBSyTZOnbY0/anxa which is a bcrypt hash of my most secure password.…

$2a$10$NkYCXBjWeVP0rJUlfl0VL.d66EvJjbVUA/YEsmBSyTZOnbY0/anxa == hunter2

Re: OVH Security Incident

#55

Post by JshWright » Tue, Jul 23, 2013, 9:24 AM UTC

tptacek wrote: post #44

JshWright wrote: post #41

Earlier quoted context omitted.

SHA512 is slower on most (all?) current GPUs, but there is plenty of hardware on which it is faster than SHA256.

Hm. Example?

It'll (theoretically) be faster on any hardware that supports 64 bit operations, as SHA512 ends up doing fewer block operations.

This assumes you're hashing something at least 8 bytes long, and that your hash implementation is smart enough to use the 64 bit capabilities of your platform.