3 ms·
Interesting investigation, I would like to see what the response from the py-bcrypt author is (since py-bcrypt is what I use in my applications).
by Ixiaus 15y ago
Interesting investigation, I would like to see what the response from the py-bcrypt author is (since py-bcrypt is what I use in my applications).
- llambda 15y agoI just started using py-bcrypt for a Flask extension I wrote. I was told there's a couple of other modules out there that support bcrypt but I was trying to find a reason to use them over py-bcrypt as it seems to be the de facto standard. Maybe this is such a reason? iirc cryptacular and bcryptor were the modules that were recommended to me.
- Ixiaus 15y agoI didn't really like cryptacular that much. I don't really know why one character of the hash is being taken off; I remember curiously wondering why that was in there when I was fiddling with the source to get it to compile on Windows. I also don't know if that would pose as a significant security threat - sure, you would be taking one character off of the number of characters that need to be brute forced, but it is only one. I'm not informed enough to give an accurate opinion. I do know, though, that jumping to conclusions before a thorough explanation is provided is silly... Hence why I'm not suddenly jumping to the use of cryptacular or others.
- StavrosK 15y agoI'm guessing it would make brute forcing about 40 times easier.
- djmdjm 15y agoBear in mind that the likelihood here is something like 2^-186
- daeken 15y agoIt would make it 256 times easier, reducing the keyspace by ~4.16%.
- StavrosK 15y agoI don't see how that can be, given that the character that's chopped off can take one of 40 values... Or is it case sensitive? Still, nowhere near 256.
- tedunangst 15y agoReducing the log of the keyspace by 4.16%, which is not a particularly interesting measurement. Reducing a key by 8 bits reduces the key space by 255/256, regardless of key size.
- tptacek 15y agoWhich is a statement not unlike talking about making it 40 times easier to travel to the Andromeda galaxy.
- StavrosK 15y agoIndeed.