4 ms·

Are incorrectly stored passwords really the problem with a lot of the last few major security breaches? For instance, I read that Sony hack was an act of social

by sakopov 11y ago

Are incorrectly stored passwords really the problem with a lot of the last few major security breaches? For instance, I read that Sony hack was an act of social engineering. Anthem was hacked via phishing attack. Ashley Madison hackers got in via SQL injection. I guess is all of this complexity really worth it for an average company when it doesn't even seem to be the root of the problem.

mikeash 11y ago
It's not really about keeping people from breaking into your site, but rather keeping them from using the data they get from your site to break into other sites. Basically, a lot of people will use the same credentials on both (for example) Ashley Madison and their bank. If AM does a bad job storing their passwords, then an SQL injection there can be used to reconstruct the users' passwords and then log into many of their banks.
- pakled_engineer 11y ago
  HSM are freely around for Ashley Madison to buy with their multi millions that are optimized for hi speed crypto functions with physical keys that can't be extracted by a remote attacker stealing the db. Since they don't bother to use easily found current solutions don't see why any of these corps with massive breaches would bother to use this beta software solution either.
sillysaurus3 11y ago
There are a few separate problems at play. Security is never one thing. The root of the password problem is that people don't use a password database. I didn't until recently, even though I was aware of the risks. It was more than I could be bothered to do. Apparently Rayiner wasn't using one until recently as well. It seems pretty likely that most people won't use one unless they're forced to. The effect of this is that if you use the same password on many services, you're at a pretty big risk. What do most users do, then? "Ah, I'm clever; I'll put the name of the service in the password." Trouble is, this is exactly the same as the previous situation. You're sharing passwords across services, whether or not you thought so. The first thing that an attacker will do when they reverse your password is scan it for instances of the service name. If your password is "DropboxFoobar", it's likely your Twitter's is "TwitterFoobar". In fact, passwords of this type are the most valuable to an attacker, because it's a surefire flag of "You can get a ton of data from this person if they use the same scheme everywhere!" (When you reverse other types of passwords, it's unclear whether it's worth the effort to try it against a bunch of services.) That said, anything to improve this situation is worthwhile effort. Whether it's a new hashing scheme or a public service video about the dangers of not using a password database, security improves incrementally. Shielding a modern company is extremely hard, as it requires all employees to use the same security measures. Anything that can be automated would be a win. Are there other automatable things besides hashing? Phishing attacks can't be detected because they're crafted so well. SQL injection can be, though: Throw your server requests through a bayesian filter and watch it decide to put requests containing SELECT into their own class automatically. Defenses to social engineering are close to impossible: if someone wants to get into your building, they'll pose as a maintenance crew. If they're discovered, they'll say "Sorry, my work order must be for a different floor." All in all, this is the general essence of why Sam Altman's desire to fund new security companies is good, but might not produce many results. So are incorrectly stored passwords really the problem? Well... Not if you're using bcrypt or scrypt. Possibly this scheme; time will tell. The research is valuable for other reasons too: it's a whitepaper with source code, which is extremely rare. Might be good to encourage more of that.

by sakopov 11y ago

mikeash 11y ago

It's not really about keeping people from breaking into your site, but rather keeping them from using the data they get from your site to break into other sites. Basically, a lot of people will use the same credentials on both (for example) Ashley Madison and their bank. If AM does a bad job storing their passwords, then an SQL injection there can be used to reconstruct the users' passwords and then log into many of their banks.

pakled_engineer 11y ago
HSM are freely around for Ashley Madison to buy with their multi millions that are optimized for hi speed crypto functions with physical keys that can't be extracted by a remote attacker stealing the db. Since they don't bother to use easily found current solutions don't see why any of these corps with massive breaches would bother to use this beta software solution either.

sillysaurus3 11y ago

There are a few separate problems at play. Security is never one thing. The root of the password problem is that people don't use a password database. I didn't until recently, even though I was aware of the risks. It was more than I could be bothered to do. Apparently Rayiner wasn't using one until recently as well. It seems pretty likely that most people won't use one unless they're forced to. The effect of this is that if you use the same password on many services, you're at a pretty big risk. What do most users do, then? "Ah, I'm clever; I'll put the name of the service in the password." Trouble is, this is exactly the same as the previous situation. You're sharing passwords across services, whether or not you thought so. The first thing that an attacker will do when they reverse your password is scan it for instances of the service name. If your password is "DropboxFoobar", it's likely your Twitter's is "TwitterFoobar". In fact, passwords of this type are the most valuable to an attacker, because it's a surefire flag of "You can get a ton of data from this person if they use the same scheme everywhere!" (When you reverse other types of passwords, it's unclear whether it's worth the effort to try it against a bunch of services.) That said, anything to improve this situation is worthwhile effort. Whether it's a new hashing scheme or a public service video about the dangers of not using a password database, security improves incrementally. Shielding a modern company is extremely hard, as it requires all employees to use the same security measures. Anything that can be automated would be a win. Are there other automatable things besides hashing? Phishing attacks can't be detected because they're crafted so well. SQL injection can be, though: Throw your server requests through a bayesian filter and watch it decide to put requests containing SELECT into their own class automatically. Defenses to social engineering are close to impossible: if someone wants to get into your building, they'll pose as a maintenance crew. If they're discovered, they'll say "Sorry, my work order must be for a different floor." All in all, this is the general essence of why Sam Altman's desire to fund new security companies is good, but might not produce many results. So are incorrectly stored passwords really the problem? Well... Not if you're using bcrypt or scrypt. Possibly this scheme; time will tell. The research is valuable for other reasons too: it's a whitepaper with source code, which is extremely rare. Might be good to encourage more of that.