3 ms·

I think if you care enough about password security to know these appliances exist, you already know how to use a proper password storage scheme. The ones that w

I think if you care enough about password security to know these appliances exist, you already know how to use a proper password storage scheme. The ones that we are seeing dumped were not even trying.

derefr 14y ago
What the parent is talking about is basically a solution to the http://en.wikipedia.org/wiki/Principal%E2%80%93agent_problem http://en.wikipedia.org/wiki/Principal%E2%80%93agent_problem. I don't think these password compromises were likely failures of management to say "let's build a secure system"; they were failures of the engineers told to "build a secure system" to know and care enough about building secure systems to learn about things like bcrypt/scrypt in the first place. The solution to this, of course, is to make password security into its own industry, with its own principals who are incentivized to understand every facet of secure systems. This would resolve as the parent explains--third-party vendors selling these companies multi-million-dollar "password appliances" with installation, support contracts, and all of that brouhaha--and then bringing in their support engineers to teach the company's own people how to securely call into the appliance.
- stcredzero 14y ago
  I don't think these password compromises were likely failures of management to say "let's build a secure system";... The solution to this...would resolve as the parent explains--third-party vendors selling these companies multi-million-dollar "password appliances" with installation, support contracts, and all of that brouhaha--and then bringing in their support engineers to teach the company's own people how to securely call into the appliance. Screw that. Just use a specific API in BSON structured with fixed-length fields to make the call. Build the appliance as proprietary software to install on top of an existing secure Linux distro. Sell to small sites for $1000 a pop or so, with different licensing for virtual server and cloud hosting companies. If Big Co. needs serious bandwidth, then they can do a project. Hardware component: that we'd need VC funding for. Hardware is just harder.
- lawnchair_larry 14y ago
  My position is that the engineers were probably told to "build a system". It's still uncommon for security to even be a thought, sadly.

derefr 14y ago

What the parent is talking about is basically a solution to the http://en.wikipedia.org/wiki/Principal%E2%80%93agent_problem http://en.wikipedia.org/wiki/Principal%E2%80%93agent_problem. I don't think these password compromises were likely failures of management to say "let's build a secure system"; they were failures of the engineers told to "build a secure system" to know and care enough about building secure systems to learn about things like bcrypt/scrypt in the first place. The solution to this, of course, is to make password security into its own industry, with its own principals who are incentivized to understand every facet of secure systems. This would resolve as the parent explains--third-party vendors selling these companies multi-million-dollar "password appliances" with installation, support contracts, and all of that brouhaha--and then bringing in their support engineers to teach the company's own people how to securely call into the appliance.

stcredzero 14y ago
I don't think these password compromises were likely failures of management to say "let's build a secure system";... The solution to this...would resolve as the parent explains--third-party vendors selling these companies multi-million-dollar "password appliances" with installation, support contracts, and all of that brouhaha--and then bringing in their support engineers to teach the company's own people how to securely call into the appliance. Screw that. Just use a specific API in BSON structured with fixed-length fields to make the call. Build the appliance as proprietary software to install on top of an existing secure Linux distro. Sell to small sites for $1000 a pop or so, with different licensing for virtual server and cloud hosting companies. If Big Co. needs serious bandwidth, then they can do a project. Hardware component: that we'd need VC funding for. Hardware is just harder.
lawnchair_larry 14y ago
My position is that the engineers were probably told to "build a system". It's still uncommon for security to even be a thought, sadly.