6 ms·

Better title would have been: Protip: if your trying to hack/deface a website, dont submit a pull request WITH YOUR EMAIL AND PASSWORD! https://github.com/Cod

Better title would have been: Protip: if your trying to hack/deface a website, dont submit a pull request WITH YOUR EMAIL AND PASSWORD! https://github.com/CoderDojo/CoderDojo-Kata/pull/2 https://github.com/CoderDojo/CoderDojo-Kata/pull/2

nachteilig 14y ago
A better title might not include puerile memes like "Protip".
- thinkling 14y ago
  Being sarcastic is puerile?
  - jlgreco 14y ago
    Also, "protip" has been in use for what, two decades now? When does something stop being a meme and just become an idiom?
    - dEnigma 14y ago
      An idiom is a meme too
      - jlgreco 14y ago
        In the sense that it is a cultural artifact that is passed along from one individual to another, yes. In the sense that it is something annoying kids on the internet use that must be complained about, no, not necessarily.
        yuchi 14y ago
        I hate the abuse of the word "meme"...
        skeletonjelly 14y ago
        Funnily enough, the abuse of the word "meme" is now a meme.
    - eropple 14y ago
      GamePro is, as far as I know, the originator, so sometime between 1989 and 1994 (first time I remember it). So, yeah, about two decades. :)
noamsml 14y ago
Yep, password is common enough to unhash pretty easily. People need to learn to salt their hashes for fuck's sake.
- alexkus 14y ago
  In this case, salting would give almost no benefit given the poor password choice. The pull request included the code that does the hashing:- if( empty( $auth_pass ) || ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) ) $_SESSION[md5($_SERVER['HTTP_HOST'])] = true; else printLogin(); So any salt [was hash] used would have to be present in the code too. Given that such a simple password (8 digits) could be brute forced in seconds on an average PC, even with a salt, it doesn't really matter whether it was salted or not. A password of "p*l12nJ9£l ~98as2389bvkqsopfq£3oef2[olpe]wog!wei^og(8ni" would take an unrealistic amount of time to brute force, even if unsalted, and it's beyond the scope of any precomputed rainbow tables for similar reasons. Anyway, it's only a concern if he uses the same password elsewhere.
  - gknoy 14y ago
    > A password of "p*l12nJ9£l ~98as2389bvkqsopfq£3oef2[olpe]wog!wei^og(8ni" would take an unrealistic amount of time to brute force, even if unsalted, and it's beyond the scope of any precomputed rainbow tables for similar reasons. Since rainbow tables look up a password via its hashed value, I believe you could find something else that has a hash collision -- for all we know, it has the same hash as 'ponies'.
    - alexkus 14y ago
      Sure, but a hash collision for a specified value is still a needle in a haystack. The sheer size of the keyspace (2^128) means that rainbow tables can only ever exist for a subset of the keyspace. 1M machines running for a year each capable of doing 20M MD5 hashes a second will still only cover 1/539514153540300709th of the MD5 keyspace. But, yes, salting would prevent the use of rainbow tables completely.

nachteilig 14y ago

A better title might not include puerile memes like "Protip".

thinkling 14y ago
Being sarcastic is puerile?
- jlgreco 14y ago
  Also, "protip" has been in use for what, two decades now? When does something stop being a meme and just become an idiom?
  - dEnigma 14y ago
    An idiom is a meme too
    - jlgreco 14y ago
      In the sense that it is a cultural artifact that is passed along from one individual to another, yes. In the sense that it is something annoying kids on the internet use that must be complained about, no, not necessarily.
      - yuchi 14y ago
        I hate the abuse of the word "meme"...
        skeletonjelly 14y ago
        Funnily enough, the abuse of the word "meme" is now a meme.
  - eropple 14y ago
    GamePro is, as far as I know, the originator, so sometime between 1989 and 1994 (first time I remember it). So, yeah, about two decades. :)

noamsml 14y ago

Yep, password is common enough to unhash pretty easily. People need to learn to salt their hashes for fuck's sake.

alexkus 14y ago
In this case, salting would give almost no benefit given the poor password choice. The pull request included the code that does the hashing:- if( empty( $auth_pass ) || ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) ) $_SESSION[md5($_SERVER['HTTP_HOST'])] = true; else printLogin(); So any salt [was hash] used would have to be present in the code too. Given that such a simple password (8 digits) could be brute forced in seconds on an average PC, even with a salt, it doesn't really matter whether it was salted or not. A password of "p*l12nJ9£l ~98as2389bvkqsopfq£3oef2[olpe]wog!wei^og(8ni" would take an unrealistic amount of time to brute force, even if unsalted, and it's beyond the scope of any precomputed rainbow tables for similar reasons. Anyway, it's only a concern if he uses the same password elsewhere.
- gknoy 14y ago
  > A password of "p*l12nJ9£l ~98as2389bvkqsopfq£3oef2[olpe]wog!wei^og(8ni" would take an unrealistic amount of time to brute force, even if unsalted, and it's beyond the scope of any precomputed rainbow tables for similar reasons. Since rainbow tables look up a password via its hashed value, I believe you could find something else that has a hash collision -- for all we know, it has the same hash as 'ponies'.
  - alexkus 14y ago
    Sure, but a hash collision for a specified value is still a needle in a haystack. The sheer size of the keyspace (2^128) means that rainbow tables can only ever exist for a subset of the keyspace. 1M machines running for a year each capable of doing 20M MD5 hashes a second will still only cover 1/539514153540300709th of the MD5 keyspace. But, yes, salting would prevent the use of rainbow tables completely.