3 ms·

Discussions regarding use of MD5 hashing is missing the point, Capital One and Equifax had plain text data exposed. The hashing strategy is irrelevant.

bootlooped 7y ago
We're talking about poor security practices that lead to increased risk to consumers right? Doesn't hashing fall within that? I didn't see anybody claiming that was the only factor, it's just one that stick out.
txcwpalpha 7y ago
"Discussing one company's bad security is irrelevant because a totally separate company had even worse security"? I don't see where you're coming from at all.
- UncleMeat 7y ago
  There are two topics that are HUGELY overrepresented in discussions of computer security: password complexity and password hashing. MD5 hashes is not good. But it also isn't catastrophe level security. If you aren't reusing passwords then the hashing choice doesn't matter since the system has already been breached. If you are reusing passwords you don't exactly want to rely on bcrypt hardness to keep you safe. If I could make the web services I use switch to MD5 hashes and spend more time on other relevant security posture, I'd very seriously consider that.
  - toyg 7y ago
    This is bad advice and you should feel bad. We know people reuse passwords. This is a non-negotiable threat model for any user-facing system. Given this, one should make password-decryption as hard as possible. MD5 is just not good enough by any standard, in 2019.
    - UncleMeat 7y ago
      We do know this. And we can also choose how we spend our energy on education and outreach. IMO, we should be pushing password managers and 2fa as hard as humanly possible. People can only integrate so much security advice. If I'm providing guidance for a business that wants to improve the security posture of its users, I'd tell them to make 2fa integration as easy as possible and to encourage their users to use password managers before spending time on the particulars of the cryptographic storage of passwords.

bootlooped 7y ago

We're talking about poor security practices that lead to increased risk to consumers right? Doesn't hashing fall within that? I didn't see anybody claiming that was the only factor, it's just one that stick out.

txcwpalpha 7y ago

"Discussing one company's bad security is irrelevant because a totally separate company had even worse security"? I don't see where you're coming from at all.

UncleMeat 7y ago
There are two topics that are HUGELY overrepresented in discussions of computer security: password complexity and password hashing. MD5 hashes is not good. But it also isn't catastrophe level security. If you aren't reusing passwords then the hashing choice doesn't matter since the system has already been breached. If you are reusing passwords you don't exactly want to rely on bcrypt hardness to keep you safe. If I could make the web services I use switch to MD5 hashes and spend more time on other relevant security posture, I'd very seriously consider that.
- toyg 7y ago
  This is bad advice and you should feel bad. We know people reuse passwords. This is a non-negotiable threat model for any user-facing system. Given this, one should make password-decryption as hard as possible. MD5 is just not good enough by any standard, in 2019.
  - UncleMeat 7y ago
    We do know this. And we can also choose how we spend our energy on education and outreach. IMO, we should be pushing password managers and 2fa as hard as humanly possible. People can only integrate so much security advice. If I'm providing guidance for a business that wants to improve the security posture of its users, I'd tell them to make 2fa integration as easy as possible and to encourage their users to use password managers before spending time on the particulars of the cryptographic storage of passwords.