3 ms·

> Do we know the encryption scheme reddit used to encrypt their password database involved in the leak? At the time of this backup, it would have been SHA1. He

> Do we know the encryption scheme reddit used to encrypt their password database involved in the leak? At the time of this backup, it would have been SHA1. Here's the relevant hashing code: https://github.com/reddit-archive/reddit/blob/4778b17e939e119417cc5ec25b82c4e9a65621b2/r2/r2/models/account.py#L244-L248 https://github.com/reddit-archive/reddit/blob/4778b17e939e11... Edit: reddit's confirmed this here: https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/e3f8og0/ https://www.reddit.com/r/announcements/comments/93qnm5/we_ha...

bredren 8y ago
While not unexpected, it is very bad for these users. This salt will do nothing to stop a cracking effort. A system with pairs of GTX 960 and GTX 1060 cards can easily check 12 billion hashes a second. This database is hosed.
zokier 8y ago
randstr has this goldnugget of a comment: """If reallyrandom = False, generates a random alphanumeric string (base-36 compatible) of length len. If reallyrandom, add uppercase and punctuation (which we'll call 'base-93' for the sake of argument) and suitable for use as salt.""" https://github.com/reddit-archive/reddit/blob/4778b17e939e119417cc5ec25b82c4e9a65621b2/r2/r2/lib/utils/utils.py#L41 https://github.com/reddit-archive/reddit/blob/4778b17e939e11... The function has specifically a flag for use as salt, but the hashing code does not actually use it. Whoops. Of course the loss here is not really that significant (~4bits of entropy), but I find it still bit funny.
- zokier 8y ago
  Picking on the code bit more while we are at it, random.choice that randstr uses is of course not backed by CSPRNG so its not ideal for salts. Although I would be shocked if attackers would be able to exploit that in any way. Kinda interesting is how they decided on specifically 3 characters for salt, which seems really low. Its not like the characters cost anything, why not 30 characters instead?

bredren 8y ago

While not unexpected, it is very bad for these users. This salt will do nothing to stop a cracking effort. A system with pairs of GTX 960 and GTX 1060 cards can easily check 12 billion hashes a second. This database is hosed.

zokier 8y ago

randstr has this goldnugget of a comment: """If reallyrandom = False, generates a random alphanumeric string (base-36 compatible) of length len. If reallyrandom, add uppercase and punctuation (which we'll call 'base-93' for the sake of argument) and suitable for use as salt.""" https://github.com/reddit-archive/reddit/blob/4778b17e939e119417cc5ec25b82c4e9a65621b2/r2/r2/lib/utils/utils.py#L41 https://github.com/reddit-archive/reddit/blob/4778b17e939e11... The function has specifically a flag for use as salt, but the hashing code does not actually use it. Whoops. Of course the loss here is not really that significant (~4bits of entropy), but I find it still bit funny.

zokier 8y ago
Picking on the code bit more while we are at it, random.choice that randstr uses is of course not backed by CSPRNG so its not ideal for salts. Although I would be shocked if attackers would be able to exploit that in any way. Kinda interesting is how they decided on specifically 3 characters for salt, which seems really low. Its not like the characters cost anything, why not 30 characters instead?