3 ms·

Also add crypto algorithms to that. I know of too many people that thought, a SHA-512 is fine for passwords. /facepalm

shandor 7y ago
Like all the mainstream Linux distributions out there? But seriously, IIRC they do 5000 rounds by default, but I've been wondering for a few years how is it that supporting nothing better than SHA512 for the whole /etc/shadow -based system is still ok? How come there's still no support for scrypt or bcrypt?
- tialaramex 7y ago
  Because it actually hardly matters at all? It's salted enough that it's not amenable to a time-space optimisation and it's pessimised enough to make trivial attacks impractical so bad guys who have the database will resort to brute force on individual passwords. At which point either you have a good password and they can't guess it or you don't. Fancier schemes are about the margin, can we make it too expensive to brute force say 8 alphanumerics? But you don't need to live in the margins and you shouldn't.
imtringued 7y ago
I don't understand this complaint. Cryptographic hashing gets obsoleted all the time. No matter which algorithm you choose you're just buying time until a better algorithm is needed. One day we will facepalm because people didn't use quantum resistant algorithms.
- colatkinson 7y ago
  A straight hashing algorithm isn't what you want for storing passwords. At a minimum, you want it salted. It's also advisable to include an iteration count so that (a) brute-forcing is harder, and (b) you can tweak just one parameter in the future to deal with hardware speed increases. At this point, you've just reinvented a KDF and should use PBKDF2, scrypt, or whatever the KDF du jour is. TL;DR storing passwords with SHA512 is bad, storing them with PBKDF2-SHA512 is ok and likely overkill.
- skunkworker 7y ago
  There's a major difference thinking it's okay to store all of the user's passwords on your site with a SHA-512 of the password vs using bcrypt/scrypt/pbkdf2 etc with a high work factor. One is just ignorant and the other is following modern practices and continually updating the work factor to address advances in computing power. When was bcrypt or pbkdf2 made obsolete as a algorithm?

Like all the mainstream Linux distributions out there? But seriously, IIRC they do 5000 rounds by default, but I've been wondering for a few years how is it that supporting nothing better than SHA512 for the whole /etc/shadow -based system is still ok? How come there's still no support for scrypt or bcrypt?

tialaramex 7y ago
Because it actually hardly matters at all? It's salted enough that it's not amenable to a time-space optimisation and it's pessimised enough to make trivial attacks impractical so bad guys who have the database will resort to brute force on individual passwords. At which point either you have a good password and they can't guess it or you don't. Fancier schemes are about the margin, can we make it too expensive to brute force say 8 alphanumerics? But you don't need to live in the margins and you shouldn't.

imtringued 7y ago

I don't understand this complaint. Cryptographic hashing gets obsoleted all the time. No matter which algorithm you choose you're just buying time until a better algorithm is needed. One day we will facepalm because people didn't use quantum resistant algorithms.

colatkinson 7y ago
A straight hashing algorithm isn't what you want for storing passwords. At a minimum, you want it salted. It's also advisable to include an iteration count so that (a) brute-forcing is harder, and (b) you can tweak just one parameter in the future to deal with hardware speed increases. At this point, you've just reinvented a KDF and should use PBKDF2, scrypt, or whatever the KDF du jour is. TL;DR storing passwords with SHA512 is bad, storing them with PBKDF2-SHA512 is ok and likely overkill.
skunkworker 7y ago
There's a major difference thinking it's okay to store all of the user's passwords on your site with a SHA-512 of the password vs using bcrypt/scrypt/pbkdf2 etc with a high work factor. One is just ignorant and the other is following modern practices and continually updating the work factor to address advances in computing power. When was bcrypt or pbkdf2 made obsolete as a algorithm?