81–90 of 527 posts
There's something poetic about people who use an Internet based service to commit adultery being exposed by crackers. With luck the fallout will break Ashley Madison too.
First online checker that I found: https://ashley.cynic.al/
Earlier quoted context omitted.
How so? Run bcrypt on 10000 most common password for each salt. Much easier than trying every password possible for each individual salt.
Bcrypt includes a (large) random salt so is not subject to rainbow table attacks. I believe therefore that will protect against identifying passwords contained in a known list. If I'm wrong about this I'd love someone to explain why to me.
"It’s important to note that salts are useless for preventing dictionary attacks or brute force attacks. You can use huge salts or many salts or hand-harvested, shade-grown, organic Himalayan pink salt. It doesn’t affect how fast an attacker can try a candidate password, given the hash and the salt from your database."
- http://codahale.com/how-to-safely-store-a-password/#
tptacek 1708 days ago
That salt is a public value. The security of salted password schemes is meant not to depend on the secrecy of the salt.
Every time this topic comes up, 15 people chime in with various schemes in which some of the "salt" is derived from the hostname and some of it is stored in an encrypted vault and some of it is inferred from the color of the user's eyes. This is why Coda is making fun of "Himalayan pink salt".
Earlier quoted context omitted.
How so? Run bcrypt on 10000 most common password for each salt. Much easier than trying every password possible for each individual salt.
Bcrypt includes a (large) random salt so is not subject to rainbow table attacks. I believe therefore that will protect against identifying passwords contained in a known list. If I'm wrong about this I'd love someone to explain why to me.
I am mainly trying to warn against the false sense of security. Salting does not magically make weak passwords secure. It makes certain types of attacks harder, but a bad password is still bad.
Earlier quoted context omitted.
Repost from a different, and now I think abandoned, thread: I'm curious - I keep getting downvoted whenever I criticise Ashley Madison on the grounds of morality. Why is this? This isn't a whinge about downvoting (if I didn't want to get downvoted I wouldn't keep posting about A-M), but a genuine inquiry into the reasons. Is it that people see discussions of morality as off-topic for HN? Do people disagree with my mo…
IMO, you're getting downvoted because your judgment of people on AM assumes facts not in evidence (i.e., that users of AM are there to cheat on their unknowing spouses), and then judges those people based on those facts that only exist in your head. It's self-aggrandizing, and the tone doesn't come off as participation in a discourse about morality as much as a narcissistic statement about the identity you'd like peo…
This is all text from the homepage of Ashley Madison:
"Ashley Madison is the world's leading married dating service for discreet encounters"
Their tagline, a registered trademark is, "Life is short. Have an affair.®"
"Ashley Madison is the most famous name in infidelity and married dating."
"Thousands of cheating wives and cheating husbands signup everyday looking for an affair. "
Earlier quoted context omitted.
How so? Run bcrypt on 10000 most common password for each salt. Much easier than trying every password possible for each individual salt.
Bcrypt includes a (large) random salt so is not subject to rainbow table attacks. I believe therefore that will protect against identifying passwords contained in a known list. If I'm wrong about this I'd love someone to explain why to me.
Let's say they cranked up bcrypt to take 10ms to run (so their system can login 100 people per second). That means it take me 10 seconds to try all 10,000 weakest passwords against an individual hash. If I can do, say, 1000 hashes in parallel, then I can try the top 10,000 passwords against 100 users' hashes a second. If their DB is 100,000,000 passwords then that's only 11 days to try the top 10,000 passwords on everyone, which is super reasonable and will get you tons of low-hanging-fruit.
In practice you can probably try a password faster than this, and massively more parallel. So that's just gravy. Also keep in mind I don't need to try all 10,000 on everyone -- if you have the most common password I can stop right away. Further, if you identify a user who's password you really want to crack, you can redirect all those resources at just that user with the full might of John the Ripper or Hashcat and try 1,000,000,000,000 common passwords and mutations against that user in the same amount of time (using my pessimistic numbers for how fast you can run).
For reference, password cracking rigs are usually talked about in terms of gigahashes/second (billions of hashes per second).
[deleted]
I grabbed the data and found an old peer in there, and he listed both our office and his home address in profiles, which he would never have done for anything else. He also used an email address on a domain he controls that he created just for that, and accessed it (there are IP addresses) from a remote corporate location while on a trip there (I actually was on the same trip with him). This is just one record, but t…
I'd be interested in seeing a schema to better understand the bredth of the data. Is that something others would feel comfortable about posting or is even that considered unethical on here. It's all a very murky area.
Earlier quoted context omitted.
The original article was specifically about the lack of concrete evidence, and didn't claim a definite answer until the update a couple of hours ago. The HN submission title had been changed before I posted, but Dang's explanation of the change posted about the same time as I did. I get it now, so by all means feel free to disagree with my original point about HN title etiquette, but please don't downvote me for fail…
FWIW, I upvoted you as I thought it was a bit harsh.