Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adobe confirms stolen passwords were encrypted, not hashed

csoonline.com

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Adobe confirms stolen passwords were encrypted, not hashed

#81

Post by Dylan16807 »

StavrosK wrote: post #76
alexkus wrote: post #73

Earlier quoted context omitted.

So do multiple things to make it harder for the naughty people, i.e. hash and then encrypt the result. Hashing or Encrypting? 1) If you have to choose one or the other then obviously hashing (with a random salt and a relatively expensive algorithm, e.g. bcrypt et al with suitable work factor) is generally the way to go. But it is still possible to brute force many of the easy passwords from a DB leak of bcrypt() hash…

I'm sorry, how can you check easy passwords with bcrypt? Hell, checking just one password per account, assuming bcrypt takes around half a second (what most reasonable implementations take) would take two years. If you want to check the 100 most common passwords for everyone, that's 200 years right there.

Half a second sounds pretty slow for authentication servers handling over 100 million accounts. Here's how I figure it: Assume about 10ms per attempt, since this is a high-throughput login system. Use a whopping 10 computers to do the cracking, and you're already under a month to try most of 100 passwords on every single account.

When using an awful password, bcrypt can only do so much. It can protect you from the ideal case of a single person with a single core that doesn't filter accounts in any way. Now consider how many people have access to this database...

Re: Adobe confirms stolen passwords were encrypted, not hashed

#82

Post by alex_doom »

RussianCow wrote: post #9
alex_doom wrote: post #7

Earlier quoted context omitted.

What does Photoshop have to do with their poor security?

I think the point is that they've had plenty of time to get their shit together. Being proud of following best practices for a year when your company has been around for three decades is pathetic.

But that's like if Microsoft had a huge fuckup and then associating their Office software with it. It's a separate team that works on it.

Re: Adobe confirms stolen passwords were encrypted, not hashed

#83

Post by nightcracker »

"Adobe says that they've followed best practices for password storage and protection for more than a year now, as their authentication systems were upgraded to use SHA-256, with salt, to protect customer passwords."

Absolute bullshit! SHA-256 with salt is totally inadequate for password storage, they should use a PBKDF like scrypt.

Re: Adobe confirms stolen passwords were encrypted, not hashed

#84

Post by viraptor »

nightcracker wrote: post #83

"Adobe says that they've followed best practices for password storage and protection for more than a year now, as their authentication systems were upgraded to use SHA-256, with salt, to protect customer passwords." Absolute bullshit! SHA-256 with salt is totally inadequate for password storage, they should use a PBKDF like scrypt.

Depends on the number of rounds used. It can be brought up to a reasonable time complexity this way and is definitely not inadequate. Worse than some alternatives? Sure. But it still gives reasonable protection.

Re: Adobe confirms stolen passwords were encrypted, not hashed

#85

Post by cormullion »

nwh wrote: post #24
smtddr wrote: post #23

Earlier quoted context omitted.

If Photoshop, basically industry standard in image-editing software, isn't an achievement... then nothing qualifies as an achievement. And this is coming from someone who prefers GIMP on linux. I would love to produce something even a quarter as popular & usable as Photoshop.

It's not. Have a look at what it's users have to put up with on a daily basis. http://bad-adobe.tumblr.com

carrying on in the tradition of

http://adobegripes.tumblr.com

Re: Adobe confirms stolen passwords were encrypted, not hashed

#86

Post by brohee »

viraptor wrote: post #84
nightcracker wrote: post #83

"Adobe says that they've followed best practices for password storage and protection for more than a year now, as their authentication systems were upgraded to use SHA-256, with salt, to protect customer passwords." Absolute bullshit! SHA-256 with salt is totally inadequate for password storage, they should use a PBKDF like scrypt.

Depends on the number of rounds used. It can be brought up to a reasonable time complexity this way and is definitely not inadequate. Worse than some alternatives? Sure. But it still gives reasonable protection.

If they said SHA-256 with salt, excuse us to think it is just that, with no iteration. If it's iterated SHA-256 it becomes a lot closer to PBKDF and one wonder why they would not use it.

Given Adobe history wrt security, let us assume the worst.

Re: Adobe confirms stolen passwords were encrypted, not hashed

#87

Post by annnnd »

po wrote: post #71
wesley wrote: post #69

Earlier quoted context omitted.

Is there an online service to check your email address is in there? I didn't get an email from them (perhaps it got stuck in my spam folder that gets auto-deleted weekly), but my credit card got hacked soon after.

This one: http://adobe.cynic.al/

What is that all about? The site makes a claim of making a search through 150mio records a big deal. Ok, it is not trivial, but any decent DB with proper indexes would have no trouble doing that. Am I missing something?

Also, they want me to enter my e/mail to check... . Seriously?

Re: Adobe confirms stolen passwords were encrypted, not hashed

#88

Post by [deleted] »

annnnd wrote: post #87
po wrote: post #71

Earlier quoted context omitted.

This one: http://adobe.cynic.al/

What is that all about? The site makes a claim of making a search through 150mio records a big deal. Ok, it is not trivial, but any decent DB with proper indexes would have no trouble doing that. Am I missing something? Also, they want me to enter my e/mail to check... . Seriously?

[deleted]

Re: Adobe confirms stolen passwords were encrypted, not hashed

#89

Post by bennyg »

annnnd wrote: post #87
po wrote: post #71

Earlier quoted context omitted.

This one: http://adobe.cynic.al/

What is that all about? The site makes a claim of making a search through 150mio records a big deal. Ok, it is not trivial, but any decent DB with proper indexes would have no trouble doing that. Am I missing something? Also, they want me to enter my e/mail to check... . Seriously?

It checks if your email is in the dump. What would you want, just a full list of everyone's emails in plaintext for the world to see?

Re: Adobe confirms stolen passwords were encrypted, not hashed

#90

Post by radiac »

bennyg wrote: post #89
annnnd wrote: post #87

Earlier quoted context omitted.

What is that all about? The site makes a claim of making a search through 150mio records a big deal. Ok, it is not trivial, but any decent DB with proper indexes would have no trouble doing that. Am I missing something? Also, they want me to enter my e/mail to check... . Seriously?

It checks if your email is in the dump. What would you want, just a full list of everyone's emails in plaintext for the world to see?

Given they're no longer secret, that would seem safer than typing my e-mail address into an untrusted site to see if it has been compromised.
Post reply on HN