4 ms·

Oh come on. Asking someone about password ecryption is basic computer science and general intelligence . Its. It about writing bcrypt. Its about thinking for f

by tamana 10y ago

Oh come on. Asking someone about password ecryption is basic computer science and general intelligence . Its. It about writing bcrypt. Its about thinking for five minutes about why we have passwords and what protection they need to be meaningful passwords.

CiPHPerCoder 10y ago
> password encryption https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...
sillysaurus3 10y ago
That you would deny someone employment at your company based on their lack of bcrypt knowledge -- knowledge which can be gained in five minutes on Google, which candidates don't have access to during an interview -- is evidence of how broken our hiring processes are. If you want secure systems, audit them.
- tensor 10y ago
  Auditing isn't enough in my experience. Most audits are just focus on paper security. They'll run nessus and some other automated tools, do no filtering and have your developers actually check any results, and then go through an extensive box checking exercise that is incapable of handling any app specific context. In the worst case, they may recommend outdated or harmful practices that will actually lower security. For example, complex password rules and rotations instead of strength checking and password managers. This leads to users just writing things down since they can't memorize ever changing passwords. Or they may force you to install antivirus on systems that don't need it, even though antivirus systems have been shown to be full of security flaws that actually weaken system security when installed into privileged or sensitive subsystems. Paper security is distinct from genuine security. They overlap certainly, but paper security is not enough to make you secure.
  - deleted 10y ago
    [deleted]
- overcast 10y ago
  People get denied employment all the time. Exceptionally good programmers, who are unable to answer those silly whiteboard questions valley companies take pride in dumping on interviewees. At least basic ideas concepts, like not storing plain text passwords, are real world things. Not masturbatory chest pumping exercises to see if a recruit is able to write a hash table, or implement a binary search tree from scratch.
SapphireSun 10y ago
I think you underestimate the difficulty of this concept. It's natural to me now, but I remember when I was first learning about this stuff, it took me months of on and off again study to understand why you do stuff, how you do stuff, and what's dumb to do, and that's just for learning the basics. If you hang out with someone who know's what they're doing, they can teach you what to do in a few pithy sentences, but the stuff about entropy and the differences between encryption, authentication, and hashing etc take time, as well as understanding what the nature of the likely attacks against these are. That is to say, you can tell someone to google and they'll find "Use bcrypt", but they'll still feel scared and confused because they don't even know if this is quality suggestion or not let alone what bcrypt is doing and why it's better than MD5.

by tamana 10y ago

CiPHPerCoder 10y ago

> password encryption https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...

sillysaurus3 10y ago

That you would deny someone employment at your company based on their lack of bcrypt knowledge -- knowledge which can be gained in five minutes on Google, which candidates don't have access to during an interview -- is evidence of how broken our hiring processes are. If you want secure systems, audit them.

tensor 10y ago
Auditing isn't enough in my experience. Most audits are just focus on paper security. They'll run nessus and some other automated tools, do no filtering and have your developers actually check any results, and then go through an extensive box checking exercise that is incapable of handling any app specific context. In the worst case, they may recommend outdated or harmful practices that will actually lower security. For example, complex password rules and rotations instead of strength checking and password managers. This leads to users just writing things down since they can't memorize ever changing passwords. Or they may force you to install antivirus on systems that don't need it, even though antivirus systems have been shown to be full of security flaws that actually weaken system security when installed into privileged or sensitive subsystems. Paper security is distinct from genuine security. They overlap certainly, but paper security is not enough to make you secure.
- deleted 10y ago
  [deleted]
overcast 10y ago
People get denied employment all the time. Exceptionally good programmers, who are unable to answer those silly whiteboard questions valley companies take pride in dumping on interviewees. At least basic ideas concepts, like not storing plain text passwords, are real world things. Not masturbatory chest pumping exercises to see if a recruit is able to write a hash table, or implement a binary search tree from scratch.

SapphireSun 10y ago

I think you underestimate the difficulty of this concept. It's natural to me now, but I remember when I was first learning about this stuff, it took me months of on and off again study to understand why you do stuff, how you do stuff, and what's dumb to do, and that's just for learning the basics. If you hang out with someone who know's what they're doing, they can teach you what to do in a few pithy sentences, but the stuff about entropy and the differences between encryption, authentication, and hashing etc take time, as well as understanding what the nature of the likely attacks against these are. That is to say, you can tell someone to google and they'll find "Use bcrypt", but they'll still feel scared and confused because they don't even know if this is quality suggestion or not let alone what bcrypt is doing and why it's better than MD5.