3 ms·
https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve..
by yread 8y ago
https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...
- setquk 8y agoAnd there's the money shot: "Hashed MAC address — Determine a cryptographically (SHA256) anonymous and unique ID for a machine. Useful to determine the aggregate number of machines that use .NET Core. This data will not be shared in the public data releases."
- JorgeGT 8y agoSomeone please correct me if I'm wrong, but (2^48 possible MAC addresses) / (60000MH/s) / (3600 s/h) = 1.3 h to calculate the SHA256 sum of every MAC address in an AWS p3.16xlarge instance (~$50) https://medium.com/@iraklis/running-hashcat-v4-0-0-in-amazons-aws-new-p3-16xlarge-instance-e8fab4541e9b https://medium.com/@iraklis/running-hashcat-v4-0-0-in-amazon...
- noir_lord 8y agoLooks about right to me. I wonder why they didn't use something like bcrypt/scrypt with lots of rounds.
- viraptor 8y agoYou may be right. But it may not be a straight sha256. It could be a multi-round hash based on sha2. In the same way shadow hashes are default called sha512, but in reality it's a 5000 round version, so your price could be $250000 instead. (Or less/more)
- Cakez0r 8y agoYou could cut down the search space a lot by only enumerating the MAC addresses of known vendors (https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4 https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd...). That cuts the search space down to 23000 vendors * 0xFFFFFF = 385875945000. With a hashrate of 60000MHs, you could SHA256 hash that entire space in 6.5 seconds. If you have an NVidia GTX 1080, you can do it in ~2 minutes 16 seconds.
- xtrapolate 8y agoIt doesn't really matter which hash function they use here... Your common MAC-48 address is a [Manufacturer ID (3 bytes), Device ID (3 bytes)], this further reduces the enumeration requirements...
- Uberphallus 8y agoBut private releases, that's a different matter...
- setquk 8y agoAnd as we know from various recent events, private releases can become public releases without proper data control.
- flukus 8y agoSo they learned that there are a lot of Linux distros and tried to cater to that and that Mac users don't like open ssl. Improvements 1 and 3 are virtually the same and 4 is just some generic padding. This is nothing they couldn't have to through more traditional and less invasive feedback mechanisms.