7 ms·

Would it be possible to come up with a simple little icon that can be put on sign-up pages to indicate that the service is using PBKDF2 or bcrypt of the like?

Would it be possible to come up with a simple little icon that can be put on sign-up pages to indicate that the service is using PBKDF2 or bcrypt of the like? Then, it would need to become popular enough for users to start to recognise it and look out for it when signing up. Even if most users don't have any idea what it's about, plenty of the more technically inclined users would, and they tend to be the early adopters anyway... The idea is to add a bit of pressure to services to store passwords correctly (similar to how users look for the green SSL bar when doing important stuff online), and providing some transparency to the users who care about this.

gizzlon 14y ago
This is a bad idea, and here's why: Honestly, I see it as almost self-evident that user would never ever learn this. But more importantly, what would stop anyone from putting up these icons? Who would check that they actually implemented it? Even if that was solved, people would just implement this one thing because it looked good. But there are plenty of other ways to ruin your password security, so you couldn't really trust them more than you could in the first place. (IMHO, this is a core issue with security standardization)
- davidjohnstone 14y ago
  Yes, most users wouldn't understand what this is. However, if some did, and they expected it to be there, that might be enough. You're quite right that there'd be nothing stopping people from using this dishonestly, except their consciences and the fact they may have some explaining to do if a dump of MD5s of their passwords was released. That may or may not be enough. In any case, I'm sure that this industry can do a bit better than it is at the moment. With big breaches of LinkedIn, Last.fm and eHarmony in the last 48 hours, surely something can be done.
  - drivebyacct2 14y ago
    Like what? The other guy was nice, but badges are flatly stupid. Unless you want to force websites to allow security inspectors, you have to either assume they're doing the right thing or believe them if they tell you "They've got it".
  - rlpb 14y ago
    The problem is that the people who don't use a KDF don't know any better. Aren't these the same sort of people who will implement the same logo as other sites use without understanding what it means? > except their consciences I would add ignorance to that list.
- mikeash 14y ago
  I think you could implement verification of the implementation by allowing a user to retrieve their own password hash. Most would have no idea what to do with it, but a few people who know what's what could use that to verify that they're using the algorithm. This does not detract from the rest of what you said, of course, and I agree that this wouldn't really be useful.

gizzlon 14y ago

This is a bad idea, and here's why: Honestly, I see it as almost self-evident that user would never ever learn this. But more importantly, what would stop anyone from putting up these icons? Who would check that they actually implemented it? Even if that was solved, people would just implement this one thing because it looked good. But there are plenty of other ways to ruin your password security, so you couldn't really trust them more than you could in the first place. (IMHO, this is a core issue with security standardization)

davidjohnstone 14y ago
Yes, most users wouldn't understand what this is. However, if some did, and they expected it to be there, that might be enough. You're quite right that there'd be nothing stopping people from using this dishonestly, except their consciences and the fact they may have some explaining to do if a dump of MD5s of their passwords was released. That may or may not be enough. In any case, I'm sure that this industry can do a bit better than it is at the moment. With big breaches of LinkedIn, Last.fm and eHarmony in the last 48 hours, surely something can be done.
- drivebyacct2 14y ago
  Like what? The other guy was nice, but badges are flatly stupid. Unless you want to force websites to allow security inspectors, you have to either assume they're doing the right thing or believe them if they tell you "They've got it".
- rlpb 14y ago
  The problem is that the people who don't use a KDF don't know any better. Aren't these the same sort of people who will implement the same logo as other sites use without understanding what it means? > except their consciences I would add ignorance to that list.
mikeash 14y ago
I think you could implement verification of the implementation by allowing a user to retrieve their own password hash. Most would have no idea what to do with it, but a few people who know what's what could use that to verify that they're using the algorithm. This does not detract from the rest of what you said, of course, and I agree that this wouldn't really be useful.