5 ms·
If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrize
by dt3ft 6y ago
If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrized queries.
[1] https://arstechnica.com/gadgets/2021/03/rookie-coding-mistake-prior-to-gab-hack-came-from-sites-cto/ https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...
- stanrivers 6y agoNiiiiice
- walrus01 6y agodrop table fash;
- Intermernet 6y agoLittle Jimmy Tables strikes again.
- _muff1nman_ 6y agoI believe Bobby Tables is the more well known name: https://xkcd.com/327/ https://xkcd.com/327/
- gibolt 6y agoMust have been changed via SQL injection
- Intermernet 6y agoYou're correct, I mis-quoted, but I'm strangely happy about that given the context :-)
- camjohnson26 6y agoI thought bcrypt had built in salts, how was he able to reverse those hashes for simple passwords? Any better algorithm to use or recommendation on salting?
- johncolanduoni 6y agoIf the password is on a short enough list, you can afford to check each hash separately with the salt.
- tptacek 6y agoSalts have virtually nothing to do with the security of password hashes. Unix password hashes have essentially always be salted; they're cracked with dictionary generators, not with rainbow tables.
- SAI_Peregrinus 6y agoAs you know (but others might not) salts aren't (just) for stopping rainbow tables. They also mean that two users picking the same password doesn't result in identical hashes. That's often a more meaningful protection than stopping rainbow tables.
- zeepzeep 6y ago> Any better algorithm to use or recommendation on salting? The only thing that works are better passwords. But in theory Argon2 should be a bit better than bcrypt.
- tsimionescu 6y agoThe salts are typically stored together with the data, as is the case here. So, if you want to see if the first password is 'password', you salt it with the first salt and hash it with bcrypt. If the result matches, you know with a huge degree of confidence[0] that indeed the first password was 'password'. You can easily do this for the entire dataset, and for a few more common passwords. [0] of course, there is a chance that you just discovered a hash collision, but that is exceedingly unlikely. It also means that Gab would have accepted 'password' as the password for that user anyway, even if the string they typed in was 'warblerer' (which it would also accept).
- stjohnswarts 6y agoA tale as old as time itself.