4 ms·

One of the examples he showed was a breach of a site that used "vBulletin" as the password encryption. I looked up what the hell this was and found this: https:

One of the examples he showed was a breach of a site that used "vBulletin" as the password encryption. I looked up what the hell this was and found this: https://www.vbulletin.com/forum/forum/vbulletin-sales-and-feedback/vbulletin-pre-sales-questions/134353-password-encryption https://www.vbulletin.com/forum/forum/vbulletin-sales-and-fe... It's basically MD5(MD5(password)+salt). It was unclear if the salt was global to the entire DB or different for every record. Surprise, yet another case of the blind leading the blind in PHP-land.

sillysaurus3 9y ago
As I understand it, the problem is that many people use the same password on every forum. When they do this, an unscrupulous webmaster can use the hash to login as these members on other forums they post at. The double-hash in vB eliminates that potential issue and adds another layer of protection to forum members. ...
thrownaway954 9y ago
that thread was from 2005... 13 years ago... would you like to quote something a little more recent???
- pmarreck 9y ago
  Sure. MtGox, a PHP site, got hacked just a handful of years ago because its creator decided to write his own encryption software.
  - thrownaway954 9y ago
    got a source on that?
    - pmarreck 9y ago
      https://pirates-forum.org/Thread-Security-At-MtGox-Much-Worse-Than-Originally-Imagined https://pirates-forum.org/Thread-Security-At-MtGox-Much-Wors... which quotes the original source, which is now down but is still available at web.archive.org: https://web.archive.org/web/20140226001727/http://blog.magicaltux.net/2010/06/27/php-can-do-anything-what-about-some-ssh/ https://web.archive.org/web/20140226001727/http://blog.magic... Additional possible info: https://www.computerworld.com/article/2476003/cybercrime-hacking/the-php-that-shagged-mtgox-bitcoin-mystery-deepens.html https://www.computerworld.com/article/2476003/cybercrime-hac...
Can_Not 9y ago
That's from 2005, and it's one of many forum software available at that time. > There's a new release of PHP that adds several features, including a new sodium extension making PHP the first programming language to adopt modern cryptography in its standard library. Surprise, yet another case of the blind leading the blind outside of PHP-land. http://www.i-programmer.info/news/98-languages/11368-php-72-with-built-in-libsodium.html http://www.i-programmer.info/news/98-languages/11368-php-72-...
strictnein 9y ago
This may surprise some people, but doing stuff like MD5(MD5(password)+salt) was seen as a rather good way of storing passwords back in the day, and probably more secure than 99% of the password storage in 2005.

sillysaurus3 9y ago

As I understand it, the problem is that many people use the same password on every forum. When they do this, an unscrupulous webmaster can use the hash to login as these members on other forums they post at. The double-hash in vB eliminates that potential issue and adds another layer of protection to forum members. ...

thrownaway954 9y ago

that thread was from 2005... 13 years ago... would you like to quote something a little more recent???

pmarreck 9y ago
Sure. MtGox, a PHP site, got hacked just a handful of years ago because its creator decided to write his own encryption software.
- thrownaway954 9y ago
  got a source on that?
  - pmarreck 9y ago
    https://pirates-forum.org/Thread-Security-At-MtGox-Much-Worse-Than-Originally-Imagined https://pirates-forum.org/Thread-Security-At-MtGox-Much-Wors... which quotes the original source, which is now down but is still available at web.archive.org: https://web.archive.org/web/20140226001727/http://blog.magicaltux.net/2010/06/27/php-can-do-anything-what-about-some-ssh/ https://web.archive.org/web/20140226001727/http://blog.magic... Additional possible info: https://www.computerworld.com/article/2476003/cybercrime-hacking/the-php-that-shagged-mtgox-bitcoin-mystery-deepens.html https://www.computerworld.com/article/2476003/cybercrime-hac...

Can_Not 9y ago

That's from 2005, and it's one of many forum software available at that time. > There's a new release of PHP that adds several features, including a new sodium extension making PHP the first programming language to adopt modern cryptography in its standard library. Surprise, yet another case of the blind leading the blind outside of PHP-land. http://www.i-programmer.info/news/98-languages/11368-php-72-with-built-in-libsodium.html http://www.i-programmer.info/news/98-languages/11368-php-72-...

strictnein 9y ago

This may surprise some people, but doing stuff like MD5(MD5(password)+salt) was seen as a rather good way of storing passwords back in the day, and probably more secure than 99% of the password storage in 2005.