6 ms·

And...you didn't explain the most important part of your ramble: > they have to be kept secret or else an attacker gains a significant advantage. Can you plea

And...you didn't explain the most important part of your ramble: > they have to be kept secret or else an attacker gains a significant advantage. Can you please explain? Why is this the case? Sorry to be snarky, but after reading your elaborate response, I was left thirsty.

tialaramex 6y ago
Without the hashes an attacker's only way to find out the password for an account is to guess. They need to try logging into the account with a guessed password. Maybe they have a very good guess, and it'll be right first time, more likely they need a few tries, even thousands or millions of tries to find the right password. Every time they try, that's another opportunity to detect the attack, to stop them or slow them down. That makes the attack less likely to be ultimately successful. Even if the system doesn't go out of its way to try to do any of those things, chances are you just can't do millions of guesses this way in a reasonable time. But if they have a password hash for the account they can check as many guesses as they can afford compute power against that hash. Millions per second on a cheap home PC is common, maybe it'd be as low as thousands per second with the best possible choice of password hash, tuned to be aggressively expensive. Much more and "authentication" becomes annoyingly expensive for the legitimate system, so it is never done in practice. If the password to be guessed is ten random alphanumerics from a decent password manager then it doesn't matter, neither approach gets the attacker in. But while my passwords are like that, my mother's passwords certainly aren't and neither are those of most normal users.
- pvg 6y ago
  The fact you can take faster guesses at them to try and recover the secret doesn't change the fact that they are, in themselves, not secrets. The whole purpose of the hashing is to make them not-secrets. They may be more sensitive in some way but they are not meaningfully 'secrets'.
  - tialaramex 6y ago
    > The whole purpose of the hashing is to make them not-secrets. I put that thought experiment there for a reason. The choice to use password hashing is in effect an admission that they'll still be secrets. We are only using a specialist password hash because we know at least some fraction of our users will be using poor quality human memorable passwords. Less fUTz2uIHExKCHbLxMgNHWhnU and more Sup3rman. If we believed users were choosing random alphanumerics like fUTz2uIHExKCHbLxMgNHWhnU then we don't need a password hash, you can just use a plain cryptohash like SHA256. It's safe, it's faster, nothing not to like about it. You can publish that hash, ain't no way anybody is going to reverse it to get the password back because there are too many possibilities to try. Try it: cbc08cf5e1039d686879535794dc3616b020aed6ff92c52bdfe0f33360eb167b But, we can't do that because we know real users aren't using such passwords. The users are picking human memorable passwords and so even after they've been stretched as much as we can stomach too many of them are still weak and so they are still secret.
    - pvg 6y ago
      The thought experiment is bad for the same reason, which you appear to agree with. The hashes are not secrets, it's just that passwords are pretty bad secrets. If I gave you an RSA modulus in which you know one factor is chosen from a range of a few trillion primes, the public key could be broken if public. The fact that typical user-chosen passwords are iffy secrets doesn't make the hashes secrets as well. The choice to use password hashing is in effect an admission that they'll still be secrets. We are only using a specialist password hash No, as you say yourself, we'd still hash if the passwords were random strings. Which turns them into non-secrets. The specialized hashing is an admission that many passwords are guessable. It sorts of sounds like you want to forklift your own terminology into this using the fact that user-selected passwords can be guessed.
      - tialaramex 6y ago
        > If I gave you an RSA modulus in which you know one factor is chosen from a range of a few trillion primes, the public key could be broken if public. And so public CAs are obliged to forbid such practices to the extent they're able to detect them. As a result on the whole users who try to use crap moduli get denied. Go try it, mint yourself an RSA pair such that the public modulus is 11 x n or something easy, and ask Let's Encrypt to issue for that key in a name you own, they'll refuse explaining that your proposed key is crap. Here's a nickel kid go buy yourself a better semi-prime. In contrast the vast majority of password protected user accounts don't even check Pwned passwords. I can sign up for a lot of stuff literally using Sup3rman as my password. > The fact that typical user-chosen passwords are iffy secrets doesn't make the hashes secrets as well. Yes, in practice it does. > as you say yourself, we'd still hash if the passwords were random strings. Which turns them into non-secrets. That works on random strings, but it doesn't work on non-random strings. No amount of processing can magically make the non-random strings be random and so Argon2id("Sup3rman") is going to need to be treated as a secret or else any fool can just try the most popular passwords and reverse it.

tialaramex 6y ago

Without the hashes an attacker's only way to find out the password for an account is to guess. They need to try logging into the account with a guessed password. Maybe they have a very good guess, and it'll be right first time, more likely they need a few tries, even thousands or millions of tries to find the right password. Every time they try, that's another opportunity to detect the attack, to stop them or slow them down. That makes the attack less likely to be ultimately successful. Even if the system doesn't go out of its way to try to do any of those things, chances are you just can't do millions of guesses this way in a reasonable time. But if they have a password hash for the account they can check as many guesses as they can afford compute power against that hash. Millions per second on a cheap home PC is common, maybe it'd be as low as thousands per second with the best possible choice of password hash, tuned to be aggressively expensive. Much more and "authentication" becomes annoyingly expensive for the legitimate system, so it is never done in practice. If the password to be guessed is ten random alphanumerics from a decent password manager then it doesn't matter, neither approach gets the attacker in. But while my passwords are like that, my mother's passwords certainly aren't and neither are those of most normal users.

pvg 6y ago
The fact you can take faster guesses at them to try and recover the secret doesn't change the fact that they are, in themselves, not secrets. The whole purpose of the hashing is to make them not-secrets. They may be more sensitive in some way but they are not meaningfully 'secrets'.
- tialaramex 6y ago
  > The whole purpose of the hashing is to make them not-secrets. I put that thought experiment there for a reason. The choice to use password hashing is in effect an admission that they'll still be secrets. We are only using a specialist password hash because we know at least some fraction of our users will be using poor quality human memorable passwords. Less fUTz2uIHExKCHbLxMgNHWhnU and more Sup3rman. If we believed users were choosing random alphanumerics like fUTz2uIHExKCHbLxMgNHWhnU then we don't need a password hash, you can just use a plain cryptohash like SHA256. It's safe, it's faster, nothing not to like about it. You can publish that hash, ain't no way anybody is going to reverse it to get the password back because there are too many possibilities to try. Try it: cbc08cf5e1039d686879535794dc3616b020aed6ff92c52bdfe0f33360eb167b But, we can't do that because we know real users aren't using such passwords. The users are picking human memorable passwords and so even after they've been stretched as much as we can stomach too many of them are still weak and so they are still secret.
  - pvg 6y ago
    The thought experiment is bad for the same reason, which you appear to agree with. The hashes are not secrets, it's just that passwords are pretty bad secrets. If I gave you an RSA modulus in which you know one factor is chosen from a range of a few trillion primes, the public key could be broken if public. The fact that typical user-chosen passwords are iffy secrets doesn't make the hashes secrets as well. The choice to use password hashing is in effect an admission that they'll still be secrets. We are only using a specialist password hash No, as you say yourself, we'd still hash if the passwords were random strings. Which turns them into non-secrets. The specialized hashing is an admission that many passwords are guessable. It sorts of sounds like you want to forklift your own terminology into this using the fact that user-selected passwords can be guessed.
    - tialaramex 6y ago
      > If I gave you an RSA modulus in which you know one factor is chosen from a range of a few trillion primes, the public key could be broken if public. And so public CAs are obliged to forbid such practices to the extent they're able to detect them. As a result on the whole users who try to use crap moduli get denied. Go try it, mint yourself an RSA pair such that the public modulus is 11 x n or something easy, and ask Let's Encrypt to issue for that key in a name you own, they'll refuse explaining that your proposed key is crap. Here's a nickel kid go buy yourself a better semi-prime. In contrast the vast majority of password protected user accounts don't even check Pwned passwords. I can sign up for a lot of stuff literally using Sup3rman as my password. > The fact that typical user-chosen passwords are iffy secrets doesn't make the hashes secrets as well. Yes, in practice it does. > as you say yourself, we'd still hash if the passwords were random strings. Which turns them into non-secrets. That works on random strings, but it doesn't work on non-random strings. No amount of processing can magically make the non-random strings be random and so Argon2id("Sup3rman") is going to need to be treated as a secret or else any fool can just try the most popular passwords and reverse it.