6 ms·
One weakness of this is that sha512sum is a fast hash, ideally it would use a slow and memory hard-hash. Of course if your password is strong enough it doesn't
by Thorrez 7y ago
One weakness of this is that sha512sum is a fast hash, ideally it would use a slow and memory hard-hash. Of course if your password is strong enough it doesn't matter.
An example attack would be an attacker compromises the password database of a site you use, and that site doesn't hash passwords. Next the attacker cracks that hash, which requires your password to be somewhat weak, but is aided by you not using a slow hash. Next the attacker uses that cracked master password variation to crack your LUKS setup. While LUKS uses a slow memory-hard hash, the attacker doesn't need to do many attempts, because the password is a small variation of the password the attacker already knows.
- zaarn 7y agoThat would matter less if you use the hash as a password as the comment suggests; in that case it matters what the website below in the stack uses.
- Thorrez 7y agoI think you misunderstand. I was talking about the case when you use the hash as the password as the comment suggests. >in that case it matters what the website below in the stack uses. I'm not sure exactly what this means. Are you saying you should put your security in the hands of website operators? I don't think you can rely on them. According to HIBP, I've been compromised by 25 breached sites and 28 pastes. I try to design my password scheme such that no matter how bad a site's security is, it has no impact on the security of anything besides that site. DyslexicAtheist's scheme doesn't have that property.