Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gab Has Been Breached

troyhunt.com

Post reply on HN
Print view View original

81–90 of 194 posts

Re: Gab Has Been Breached

#81

Post by tptacek »

camjohnson26 wrote: post #59
dt3ft wrote: post #46

If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrized queries. [1] https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...

I thought bcrypt had built in salts, how was he able to reverse those hashes for simple passwords? Any better algorithm to use or recommendation on salting?

Salts have virtually nothing to do with the security of password hashes. Unix password hashes have essentially always be salted; they're cracked with dictionary generators, not with rainbow tables.

Re: Gab Has Been Breached

#83

Post by zeepzeep »

camjohnson26 wrote: post #59
dt3ft wrote: post #46

If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrized queries. [1] https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...

I thought bcrypt had built in salts, how was he able to reverse those hashes for simple passwords? Any better algorithm to use or recommendation on salting?

> Any better algorithm to use or recommendation on salting?

The only thing that works are better passwords. But in theory Argon2 should be a bit better than bcrypt.

Re: Gab Has Been Breached

#84

Post by walrus01 »

pope_meat wrote: post #24

I'm very tired and for a moment I read it as: "God Has Been Breached" First RSA falls, now god, what's next.

If one were to posit that we are in fact living in a simulation of some sort, breaching god would probably look something like a method to gain host bare-metal memory access or code to escape from a virtual machine.

Re: Gab Has Been Breached

#85

Post by a_bonobo »

m8s wrote: post #61

This is a pretty non-political rundown from Troy, and a great read as always. It's not always easy to find trustworthy people, but he's one of them. If anyone is offended by supposed political leanings in this article, I'd suggest separating Torba's political views from his words. Blaming a data breach on "mentally ill tranny demon hackers" (his words, not mine) is not a sane or rational thought. The most realistic s…

>The most realistic scenario is that he knows exactly what he's saying and is doing so simply to rile up fanatics,

I don't know, if there's one thing I've learned from Q-anon and other modern cultists is that they are who they tell you they are. There's no need for mental gymnastics on our part to explain awful behaviour away.

Re: Gab Has Been Breached

#86

Post by hiram112 »

encryptluks2 wrote: post #5

Gab is a joke. I got banned for making a post asking how are all the domestic terrorists Trump supporters doing after the capitol riot. I guess that is ban-worthy on their free speech network while advocating for assassinating public officials is a-ok.

Probably a difference between actual debate where people disagree and outright trolling. Your comment is the latter.

Re: Gab Has Been Breached

#87

Post by walrus01 »

a_bonobo wrote: post #85
m8s wrote: post #61

This is a pretty non-political rundown from Troy, and a great read as always. It's not always easy to find trustworthy people, but he's one of them. If anyone is offended by supposed political leanings in this article, I'd suggest separating Torba's political views from his words. Blaming a data breach on "mentally ill tranny demon hackers" (his words, not mine) is not a sane or rational thought. The most realistic s…

>The most realistic scenario is that he knows exactly what he's saying and is doing so simply to rile up fanatics, I don't know, if there's one thing I've learned from Q-anon and other modern cultists is that they are who they tell you they are. There's no need for mental gymnastics on our part to explain awful behaviour away.

It's sometimes hard to tell the difference between the grifters who are parroting the qanon lingo in some sort of short term attempt to make a buck or gain a following, and the true believers. In the end, if it causes the same effects by poisoning rational public discourse, does it matter whether somebody is cosplaying as a qanon believer or not?

Re: Gab Has Been Breached

#88

Post by tsimionescu »

camjohnson26 wrote: post #59
dt3ft wrote: post #46

If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrized queries. [1] https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...

I thought bcrypt had built in salts, how was he able to reverse those hashes for simple passwords? Any better algorithm to use or recommendation on salting?

The salts are typically stored together with the data, as is the case here. So, if you want to see if the first password is 'password', you salt it with the first salt and hash it with bcrypt. If the result matches, you know with a huge degree of confidence[0] that indeed the first password was 'password'. You can easily do this for the entire dataset, and for a few more common passwords.

[0] of course, there is a chance that you just discovered a hash collision, but that is exceedingly unlikely. It also means that Gab would have accepted 'password' as the password for that user anyway, even if the string they typed in was 'warblerer' (which it would also accept).

Re: Gab Has Been Breached

#89

Post by gfosco »

juicyjuicytemp wrote: post #67

Some bit of gossip about the CTO of Gab, seeing as how I've got a bit of context. (Throwaway, for obvious reasons.) The CTO was never a software engineer. They were a developer advocate so had some interaction with code, but was more of a "talk to developers using things and make sure the requirements were passed along to the dev team" sort of guy, rather than someone that knew his technical details (beyond say, the…

You know pretty much nothing about me, unsurprisingly. I certainly don't need your pity, lol, this last year has been one of the best.

Re: Gab Has Been Breached

#90

Post by gfosco »

spamizbad wrote: post #40
jb775 wrote: post #22

Earlier quoted context omitted.

I bet it felt good to create an account for a website just so you could log in and say "how are all the domestic terrorists Trump supporters doing after the capitol riot?". That's pretty much the online equivalent of peeling-out in your car and thinking it made you look awesome.

True but it’s also free speech and as such should be permitted on a social network oriented around free speech. Unless trolling doesn’t count as free speech?

With that definition, would you think unlimited spam is also ok? Most likely you got reported by the community and picked up by the same sort of algorithm that exists on every other platform.
Post reply on HN