4 ms·

No, he's absolutely right. Single-iteration SHA-1 is extremely inappropriate for password hashing, and all salting does is prevent rainbow table attacks and ins

by rudolf0 10y ago

No, he's absolutely right. Single-iteration SHA-1 is extremely inappropriate for password hashing, and all salting does is prevent rainbow table attacks and instant reversal of duplicate hashes. It does not slow down non-precomputed attacks one bit. It's much better than plaintext, but essentially only a little bit better than unsalted MD5. I'm really surprised Tumblr would use such an awful password storage scheme as late as 2013. I thought they invested a lot into security?

vonmoltke 10y ago
From the perspective of trying to crack a single user's account the salt does not slow down non-precomputed attacks at all. From the perspective of trying to crack the entire database, or a significant portion of it, it multiples the work required by N (where N is the desired number of cracks to perform).
- rudolf0 10y ago
  I mean, it depends how you look at it. I consider precomputed attacks a special case of these attacks, sort of. In the security world, most password-predicting attacks are linear with respect to the amount of accounts you're trying to get passwords for. It's true that it will take a lot of hardware to efficiently attack all 65 million passwords. But in my field, big dumps like these are a godsend when doing a pentest. Looking to compromise a sysadmin's account? Search his/her emails and aliases in as many DB dumps as you can find, then expend a lot of resources cracking that one hash. If it's just a SHA-1 hash and the password isn't very strong, you won't have much trouble. Also a risk for people with vendettas against specific tumblr users (which, to my understanding, is a big issue on tumblr).
xyience 10y ago
Brute force as an attack vector is dealt with by requiring "strong" passwords, not by using scrypt, so the thought of using a hash that protects all passwords equally with respect to the time it takes to try one, as an extra layer of defense for those weakest of the "strong" passwords, doesn't usually come up unless you're actually looking into how to design a login system instead of just copying from somewhere/some book as fast as you can and moving on. This issue with Tumblr that late doesn't surprise me at all. At least one major benefit of SHA over MD5 is that you won't trivially find collisions and thus compromise the accounts of even those users with strong passwords...

by rudolf0 10y ago

vonmoltke 10y ago

From the perspective of trying to crack a single user's account the salt does not slow down non-precomputed attacks at all. From the perspective of trying to crack the entire database, or a significant portion of it, it multiples the work required by N (where N is the desired number of cracks to perform).

rudolf0 10y ago
I mean, it depends how you look at it. I consider precomputed attacks a special case of these attacks, sort of. In the security world, most password-predicting attacks are linear with respect to the amount of accounts you're trying to get passwords for. It's true that it will take a lot of hardware to efficiently attack all 65 million passwords. But in my field, big dumps like these are a godsend when doing a pentest. Looking to compromise a sysadmin's account? Search his/her emails and aliases in as many DB dumps as you can find, then expend a lot of resources cracking that one hash. If it's just a SHA-1 hash and the password isn't very strong, you won't have much trouble. Also a risk for people with vendettas against specific tumblr users (which, to my understanding, is a big issue on tumblr).

xyience 10y ago

Brute force as an attack vector is dealt with by requiring "strong" passwords, not by using scrypt, so the thought of using a hash that protects all passwords equally with respect to the time it takes to try one, as an extra layer of defense for those weakest of the "strong" passwords, doesn't usually come up unless you're actually looking into how to design a login system instead of just copying from somewhere/some book as fast as you can and moving on. This issue with Tumblr that late doesn't surprise me at all. At least one major benefit of SHA over MD5 is that you won't trivially find collisions and thus compromise the accounts of even those users with strong passwords...