3 ms·

how does HN store passwords? Unsalted SHA1. (def shash (str) (let fname (+ "/tmp/shash" (rand-string 10)) (w/outfile f fname (disp str f))

by Zak 15y ago

how does HN store passwords? Unsalted SHA1. (def shash (str) (let fname (+ "/tmp/shash" (rand-string 10)) (w/outfile f fname (disp str f)) (let res (tostring (system (+ "openssl dgst -sha1 <" fname))) (do1 (cut res 0 (- (len res) 1)) (rmfile fname))))) ... (and user pw (aand (shash pw) (is it (hpasswords* user))))

rimantas 15y ago
It may store it as plaintext as well, without HTTPS it does not really matter. I mean it is easier to obtain passwords with tools like firesheep instead of trying to break into DB. On the other hand, it is not like you have something secret there. The worst thing that could happen is someone pretending to be you. That said I'd love to have https option.
bigiain 15y ago
Kind of proving my point. You'd hope somewhere that calls itself "hackernews" and which may as well have an echo-bot set up quoting that codahale article about bcrypt any time someone writes "password" - might be handling passwords "properly". SHA1 isn't really all that different from Gawkers MD5 password ballsup... Instead, all the top 25 passwords found in the recent Sony exposures from here: http://www.troyhunt.com/2011/06/brief-sony-password-analysis.html http://www.troyhunt.com/2011/06/brief-sony-password-analysis... are found in that well known rainbow table, Google... iains-imac: bigiain$ echo -n 'bailey' | openssl sha1 b1f45ed147d6803ac1a2a91bdea1fab603f910a5 http://www.google.com/search?q=b1f45ed147d6803ac1a2a91bdea1fab603f910a5 http://www.google.com/search?q=b1f45ed147d6803ac1a2a91bdea1f... If HN ever gets 0wn3d, anybody with a (password) dictionary word or 8-9 char or less password will almost certainly be exposed. (even if the database doesn't get broken into, anybody who gets enough shell on the webserver to read /tmp/shash will be able to see cleartext passwords passing through...)
- Zak 15y ago
  There isn't a database per se - usernames and password hashes are stored in a file. If someone managed to read that file, it would not be difficult for them to obtain most of the passwords.

by Zak 15y ago

rimantas 15y ago

It may store it as plaintext as well, without HTTPS it does not really matter. I mean it is easier to obtain passwords with tools like firesheep instead of trying to break into DB. On the other hand, it is not like you have something secret there. The worst thing that could happen is someone pretending to be you. That said I'd love to have https option.

bigiain 15y ago

Kind of proving my point. You'd hope somewhere that calls itself "hackernews" and which may as well have an echo-bot set up quoting that codahale article about bcrypt any time someone writes "password" - might be handling passwords "properly". SHA1 isn't really all that different from Gawkers MD5 password ballsup... Instead, all the top 25 passwords found in the recent Sony exposures from here: http://www.troyhunt.com/2011/06/brief-sony-password-analysis.html http://www.troyhunt.com/2011/06/brief-sony-password-analysis... are found in that well known rainbow table, Google... iains-imac: bigiain$ echo -n 'bailey' | openssl sha1 b1f45ed147d6803ac1a2a91bdea1fab603f910a5 http://www.google.com/search?q=b1f45ed147d6803ac1a2a91bdea1fab603f910a5 http://www.google.com/search?q=b1f45ed147d6803ac1a2a91bdea1f... If HN ever gets 0wn3d, anybody with a (password) dictionary word or 8-9 char or less password will almost certainly be exposed. (even if the database doesn't get broken into, anybody who gets enough shell on the webserver to read /tmp/shash will be able to see cleartext passwords passing through...)

Zak 15y ago
There isn't a database per se - usernames and password hashes are stored in a file. If someone managed to read that file, it would not be difficult for them to obtain most of the passwords.