6 ms·

A bit of an overkill, no? Doesn't bcrypt suffice?

hellofunk 10y ago
you can't have too much security, ever. especially not when loads of personal files and potential sensitive data are getting stored under said security.
- crpatino 10y ago
  Security is not free (as in beer); there exists some level of security that costs $X. If the value of the thing you are protecting behind that security is $Y, then for every X such that X > Y, your security level is a luxury. Furthermore, there is another number Z, that represents your total operational costs $Z. You could argue that for every X/Z > 0.1^T, where T is an arbitrary threashold, X is a significant cost to the organization and you cannot affort to take that luxury without risking bankrupcy. So, yeah, Drobox stores loads of personal files... but people with real secrets to keep should know not to rely on freemium services.
tbronchain 10y ago
They have an history about stolen passwords... I guess they learnt from it. Also, I don't think any security would be overkill when you manage perosnal and professional data of millions of people!
- martinko 10y ago
  > Also, I don't think any security would be overkill Thats just nonsense. After a certain point, more security makes little sense. Would you advocate 5 trillion rounds of sha512 for each password?
  - mseebach 10y ago
    If 5 trillion rounds of sha512 is how many you can get in 100ms, then that's the right number. In other words, 5 trillion rounds isn't overkill, it's impractical.
deleted 10y ago
[deleted]
OskarS 10y ago
Assume their salt+hash database leaks. It's true that salting the passwords and using bcrypt would prevent mass cracking of the database (i.e. you would have to crack each password individually, not the entire database at once), it would still be feasible to crack a single user's password if it was weak enough (which would be worth it, if the user is, say, president@whitehose.gov). Using pepper prevents that from happening, and storing it separately from your database makes it much harder to get both.
- Achshar 10y ago
  > it would still be feasible to crack a single user's password if it was weak enough I'm sorry, but how? You'd need data centers worth of effort for many years.
  - OskarS 10y ago
    They say that the bcrypt hashing takes 100 ms on their servers. If we take that as our limitations, it means we can try 10 passwords per second. So if you had a dictionary of common passwords, plus the salt, you could try 36000 passwords per hour. If the password is "password12345" (hence "weak enough"), you could feasibly crack that. (I should say I'm not a professional security engineer so I'm probably wrong about everything and would appreciate corrections. )
    - Someone1234 10y ago
      Great analysis (that in my experience is largely accurate). Just want to tack on one footnote: 100 ms is based on a single CPU core. Most CPUs have 4-8 cores. So instead of 10 passwords a second you could argue 40-80 passwords a second is believable with concurrent operations (which all popular hash cracking software supports). It is definitely viable to break a single user's hashed password no matter what the scheme or work factor. Strong hashing algorithms with high work factors just stop you breaking multiple user's passwords quickly (and gives you 1-3 days of delay). It is a stop gap, not impenetrable defence like some believe. All technical people need to take a day and learn how to break password hashes. Not just the theory, but go download the software and actually do it.
zeveb 10y ago
> Doesn't bcrypt suffice? No, not really. It truncates large passphrases, which is just … foolish.

you can't have too much security, ever. especially not when loads of personal files and potential sensitive data are getting stored under said security.

crpatino 10y ago
Security is not free (as in beer); there exists some level of security that costs $X. If the value of the thing you are protecting behind that security is $Y, then for every X such that X > Y, your security level is a luxury. Furthermore, there is another number Z, that represents your total operational costs $Z. You could argue that for every X/Z > 0.1^T, where T is an arbitrary threashold, X is a significant cost to the organization and you cannot affort to take that luxury without risking bankrupcy. So, yeah, Drobox stores loads of personal files... but people with real secrets to keep should know not to rely on freemium services.

tbronchain 10y ago

They have an history about stolen passwords... I guess they learnt from it. Also, I don't think any security would be overkill when you manage perosnal and professional data of millions of people!

martinko 10y ago
> Also, I don't think any security would be overkill Thats just nonsense. After a certain point, more security makes little sense. Would you advocate 5 trillion rounds of sha512 for each password?
- mseebach 10y ago
  If 5 trillion rounds of sha512 is how many you can get in 100ms, then that's the right number. In other words, 5 trillion rounds isn't overkill, it's impractical.

deleted 10y ago

[deleted]

OskarS 10y ago

Assume their salt+hash database leaks. It's true that salting the passwords and using bcrypt would prevent mass cracking of the database (i.e. you would have to crack each password individually, not the entire database at once), it would still be feasible to crack a single user's password if it was weak enough (which would be worth it, if the user is, say, president@whitehose.gov). Using pepper prevents that from happening, and storing it separately from your database makes it much harder to get both.

Achshar 10y ago
> it would still be feasible to crack a single user's password if it was weak enough I'm sorry, but how? You'd need data centers worth of effort for many years.
- OskarS 10y ago
  They say that the bcrypt hashing takes 100 ms on their servers. If we take that as our limitations, it means we can try 10 passwords per second. So if you had a dictionary of common passwords, plus the salt, you could try 36000 passwords per hour. If the password is "password12345" (hence "weak enough"), you could feasibly crack that. (I should say I'm not a professional security engineer so I'm probably wrong about everything and would appreciate corrections. )
  - Someone1234 10y ago
    Great analysis (that in my experience is largely accurate). Just want to tack on one footnote: 100 ms is based on a single CPU core. Most CPUs have 4-8 cores. So instead of 10 passwords a second you could argue 40-80 passwords a second is believable with concurrent operations (which all popular hash cracking software supports). It is definitely viable to break a single user's hashed password no matter what the scheme or work factor. Strong hashing algorithms with high work factors just stop you breaking multiple user's passwords quickly (and gives you 1-3 days of delay). It is a stop gap, not impenetrable defence like some believe. All technical people need to take a day and learn how to break password hashes. Not just the theory, but go download the software and actually do it.

zeveb 10y ago

> Doesn't bcrypt suffice? No, not really. It truncates large passphrases, which is just … foolish.