4 ms·

Yeah, when this very first happened, I was in the IRC room at onlyonetv interviewed Mark (via proxy). I kept shouting in IRC to ask them to use bcrypt and was t

Yeah, when this very first happened, I was in the IRC room at onlyonetv interviewed Mark (via proxy). I kept shouting in IRC to ask them to use bcrypt and was told they were doing 1000xSHA-512. I later tweeted at MagicalTux to recommend bcrypt and was asked if multiple iterations of SHA-512 is good enough. He said that he was told bcrypt was not secure enough. How do these businesses succeed with business people that have no business wit about them, have NO ability to communicate effectively in these critical situations and have awful taste in technical advice? Google "bcrypt sha-512 hash passwords" and tell me if it's a hard call to make. You should have heard these guys within the first 36-hours answering questions. Even the business guy over at TradeHill, "Well, you know after mtgox, we need to do a lot to beef up our security". Even if that's a true statement, what a ridiculously terrible way to phrase it. I think speech and debate classes should be required for everyone to graduate highschool, let alone college. People aren't good at thinking on their feet and speaking in critical situations where wording makes a difference. When you're in the business of being an online bank for an uninsured (nearly) untraceable currency, mis-speaking like this costs you your most important asset: TRUST. That's not even touching the tip of the iceberg of lies and misinformation that has come out of mtgox. Anyone that leaves a penny in any mtgox account is an idiot.

puredemo 15y ago
>How do these businesses succeed with business people that have no business wit about them, have NO ability to communicate effectively in these critical situations and have awful taste in technical advice? They take off because they are excellent, useful and timely ideas. Unfortunately, people who have strong, timely ideas, like this one, frequently aren't able to find good technical co-founders, probably because of the "ideas are worthless" meme so many hackers love to recite nowadays. So the ideas take off anyway, but the sites basically don't have the technical architecture that they should and have to be rewritten later.
- alsocasey 15y ago
  Ideas are worthless refers to the fact that an obvious thing is obvious - I would argue that most ideas that go on to become successful products are obvious. Seldom are they really revolutionary. The implementation might be, but the idea itself seldom is. In the current case, well just because it isn't perfect from a technical standpoint, doesn't mean it wasn't the best execution of the idea out in the wild...
- sunchild 15y ago
  It's a shame that they can't be bothered to learn about security, since they're in the business of holding other people's money. It seems that they have killed their amazing opportunity, and deeply harmed the public's confidence in bitcoin at the same time.
  - rms 15y ago
    No, it seems to have gone fine. A lot of people (including Mt. Gox) decided to start taking security more seriously, and the price of Bitcoin has increased slightly.
    - sunchild 15y ago
      "No, it seems to have gone fine." You really think so? I find that statement sort of amazing. I guess ever the optimist, right?
yuhong 15y ago
Don't confuse SHA-512 hashing once with SHA-512 hashing 1000 times though.
- bradleyland 15y ago
  No one is confused. SHA-512 is designed to be very, very fast. I just ran a very rudimentary test comparing SHA-512 and BCrypt with these results. BCrypt 1000 iteration test script: https://gist.github.com/1058610 https://gist.github.com/1058610 # => That took 76.370953 seconds BCrypt 1 iteration test script: (same as above but with `1.times do`) # => That took 0.074209 seconds SHA512 1000 iteration test script: # => That took 0.004092 seconds SHA512 at 1000 iterations is over 18,000 times faster than BCrypt at similar iterations; which, by the way, makes no sense to do. BCrypt has a "cost" factor, which is used to adjust the computational complexity to your use case. This is why BCrypt makes so much more sense for password encryption than something like SHA512. Running SHA512 n times is just a cheap, ineffective imitation of BCrypt.

puredemo 15y ago

>How do these businesses succeed with business people that have no business wit about them, have NO ability to communicate effectively in these critical situations and have awful taste in technical advice? They take off because they are excellent, useful and timely ideas. Unfortunately, people who have strong, timely ideas, like this one, frequently aren't able to find good technical co-founders, probably because of the "ideas are worthless" meme so many hackers love to recite nowadays. So the ideas take off anyway, but the sites basically don't have the technical architecture that they should and have to be rewritten later.

alsocasey 15y ago
Ideas are worthless refers to the fact that an obvious thing is obvious - I would argue that most ideas that go on to become successful products are obvious. Seldom are they really revolutionary. The implementation might be, but the idea itself seldom is. In the current case, well just because it isn't perfect from a technical standpoint, doesn't mean it wasn't the best execution of the idea out in the wild...
sunchild 15y ago
It's a shame that they can't be bothered to learn about security, since they're in the business of holding other people's money. It seems that they have killed their amazing opportunity, and deeply harmed the public's confidence in bitcoin at the same time.
- rms 15y ago
  No, it seems to have gone fine. A lot of people (including Mt. Gox) decided to start taking security more seriously, and the price of Bitcoin has increased slightly.
  - sunchild 15y ago
    "No, it seems to have gone fine." You really think so? I find that statement sort of amazing. I guess ever the optimist, right?

yuhong 15y ago

Don't confuse SHA-512 hashing once with SHA-512 hashing 1000 times though.

bradleyland 15y ago
No one is confused. SHA-512 is designed to be very, very fast. I just ran a very rudimentary test comparing SHA-512 and BCrypt with these results. BCrypt 1000 iteration test script: https://gist.github.com/1058610 https://gist.github.com/1058610 # => That took 76.370953 seconds BCrypt 1 iteration test script: (same as above but with `1.times do`) # => That took 0.074209 seconds SHA512 1000 iteration test script: # => That took 0.004092 seconds SHA512 at 1000 iterations is over 18,000 times faster than BCrypt at similar iterations; which, by the way, makes no sense to do. BCrypt has a "cost" factor, which is used to adjust the computational complexity to your use case. This is why BCrypt makes so much more sense for password encryption than something like SHA512. Running SHA512 n times is just a cheap, ineffective imitation of BCrypt.