Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

571–580 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#571

Post by syncsynchalt »

danielweber wrote: post #354
user5994461 wrote: post #278

Earlier quoted context omitted.

It's one way to do it, which is okay sometimes. The other way is to add a new empty column for bcrypt. The next time the user logs in, you save the bcrypt hash and you remove the MD5 hash. Over time, the active users will be migrated to the new scheme. The only issue is the abandoned accounts, they'll keep the old weak scheme.

There are other migration techniques. If you know md5(password), you can create bcrypt(md5(password)).

That's what I do, though care should be taken that you can't then login against the old passwords by putting md5(password) in the password field.

Usually you do this by decorating the bcrypt(md5(p)) entries in some way so you can recognize which ones are tested with bcrypt() vs bcrypt(md5()).

Re: Yahoo discloses hack of 1B accounts

#572

Post by syncsynchalt »

blauditore wrote: post #551

In the context of (unsalted) MD5 passwords: If they have a large legacy base of MD5 hashed ones, how would one "move" those to a stronger hash function? I can imagine something like re-hashing the existing one with a better algorithm and some salt, and storing new ones solely using the new algorithm + salt. But that introduces some additional complexity because every hash needs information about how it was hashed (MD…

Yes, there is.

The one I prefer, which you've mostly laid out, is: new passwords are entered as bcrypt(pw) and then stored as "B-$result", old passwords are re-hashed as bcrypt(hash) = bcrypt(md5(pw)) and stored as "M-$result", then your auth function works as follows:

    def auth(user, pw):
      hash = get_hash(user)
      if hash starts with "B-":
        return hash == bcrypt(pw)
      else if hash starts with "M-":
        return hash == bcrypt(md5(pw))
      else:
        # remove this once you've rehashed your entire database
        return hash == md5(pw)
The naïve solution is to skip the "B-"/"M-"/"" annotation but if you do that you've introduced a situation where attackers can login to old passwords using md5 leaked from another source.

Re: Yahoo discloses hack of 1B accounts

#573

Post by HappyTypist »

syncsynchalt wrote: post #572
blauditore wrote: post #551

In the context of (unsalted) MD5 passwords: If they have a large legacy base of MD5 hashed ones, how would one "move" those to a stronger hash function? I can imagine something like re-hashing the existing one with a better algorithm and some salt, and storing new ones solely using the new algorithm + salt. But that introduces some additional complexity because every hash needs information about how it was hashed (MD…

Yes, there is. The one I prefer, which you've mostly laid out, is: new passwords are entered as bcrypt(pw) and then stored as "B-$result", old passwords are re-hashed as bcrypt(hash) = bcrypt(md5(pw)) and stored as "M-$result", then your auth function works as follows: def auth(user, pw): hash = get_hash(user) if hash starts with "B-": return hash == bcrypt(pw) else if hash starts with "M-": return hash == bcrypt(md5…

The other solution (that Yahoo used) is use bcrypt(md5(password)) which allows them to rehash all existing passwords without logging in.

Re: Yahoo discloses hack of 1B accounts

#574

Post by XorNot »

shawnz wrote: post #532
libeclipse wrote: post #458

Earlier quoted context omitted.

I can't think of any security implications of hashing on the client-side. What's your thinking?

If the hashes are leaked, you could log in with them.

Well serverside you store them as plaintext equivalents - i.e. salt+hash the hash. So a leak doesn't leak the user-side.

Re: Yahoo discloses hack of 1B accounts

#575

Post by Apocryphon »

234dd57d2c8db wrote: post #460
mlangdon wrote: post #272

Earlier quoted context omitted.

This is technically true, which is the best kind of true. Swap in nationalist, chauvinist. It's utterly clear what was meant by racism above, in spite of your semantics.

Racist is the laziest argument ever and it's diluting the word. If people were more accurate about describing problems, their criticisms wouldn't be dismissed to easily. A perfect example is Donald Trump. Every argument about Trump became "he's a racist!!11", which caused people to ignore and focus on the wrong problems with him! There was a lot of negatives to Trump, and yet everyone just said "Racist, boom I don't…

That's true. That's why there's also the umbrella term, "bigoted", when referring to bias stemming from ignorant prejudice. The watering down of "racist" to equal all forms of bigot is indeed a problem, and you have brought up a valid concern.

Re: Yahoo discloses hack of 1B accounts

#576

Post by agf »

DougBTX wrote: post #228
agf wrote: post #91

Earlier quoted context omitted.

If it's a password so long and complex it wouldn't be in any rainbow table computable in reasonable time. While MD5 can be computed quickly, there is still a limit to how many you can compute -- and there are an infinite number of possible passwords if they aren't length limited.

Interestingly even if the password has infinite length, an MD5 hash has a fixed finite length. You can think of it as a glorified modulus operator, beyond some point the longer passwords will have hashes that match shorter ones.

True -- but assuming these passwords aren't stored the same (very, very wrong) way on another site, and they're no longer useful on Yahoo, what's important is finding the real password, not just a password that happens to match the given hash.

Re: Yahoo discloses hack of 1B accounts

#577

Post by blauditore »

HappyTypist wrote: post #573
syncsynchalt wrote: post #572

Earlier quoted context omitted.

Yes, there is. The one I prefer, which you've mostly laid out, is: new passwords are entered as bcrypt(pw) and then stored as "B-$result", old passwords are re-hashed as bcrypt(hash) = bcrypt(md5(pw)) and stored as "M-$result", then your auth function works as follows: def auth(user, pw): hash = get_hash(user) if hash starts with "B-": return hash == bcrypt(pw) else if hash starts with "M-": return hash == bcrypt(md5…

The other solution (that Yahoo used) is use bcrypt(md5(password)) which allows them to rehash all existing passwords without logging in.

I think that's what he described, plus adding a prefix in order to indicate it's been re-hashed.

Re: Yahoo discloses hack of 1B accounts

#578

Post by kaeluka »

blowski wrote: post #466
kijin wrote: post #418

Earlier quoted context omitted.

Or you could SHA256 the original password and feed the hash to bcrypt. Remember to use the 64-byte hexadecimal hash, not the 32-byte binary because bcrypt chokes on null bytes. Everyone's been saying "just use bcrypt", but bcrypt has too many gotchas to be the default choice. We really need to work on getting scrypt and argon2 into the most popular programming languages and frameworks a.s.a.p.

> Everyone's been saying "just use bcrypt", but bcrypt has too many gotchas to be the default choice This has got to be the underlying problem of modern security. By the time a best practice is well known, it's no longer best practice.

Like nutrition!

Re: Yahoo discloses hack of 1B accounts

#579

Post by tweakserver »

cm2187 wrote: post #82
ausjke wrote: post #24

I'm speechless. More and more are migrating to cloud these days, I expect more and more epidemic leakage will come. I host everything myself except for email, which is always a headache but contains more private info than all others I manage combined. Maybe it is time to run a small email server again but it is easily said than done, gosh please give me something like a working PGP or whatever for safe emails(PGP is…

The complexity isn't that much of a problem. Windows server + smartermail has a nice UI all the way. The problem is cost. [edit] by the way I wonder how useful would be a tutorial "for dummies" of how to set up your own mail server from scratch. I assume that users who would be happy to pay for their own server but feel it is too complicated would likely be windows users, i.e. wouldn't mind having to pay for a licens…

SmarterMail have both perpetual + monthly lease licensing options. Leasing of SmarterMail Pro 250 Mailboxes was as low as $15/mo. Overall SmarterMail have a easy installation and all the management is via the web interface.

if you are looking for a perpetual license, grab the 46% discount that's going to end by 31/12/2016 from https://www.tweakservers.com/mail-servers/smartermail/

Re: Yahoo discloses hack of 1B accounts

#580

Post by barking »

slig wrote: post #521
barking wrote: post #487

Earlier quoted context omitted.

Paypal says I can't change it because it's my primary email address. I prefer using authenticator anyway rather than sms 2fa and yahoo don't offer that it seems

Maybe you have to add a new email to your paypal account, then change it to be the primary and then delete the old one.

You're right! Thanks very much.
Post reply on HN