4 ms·

So you're saying if you were given a mouse movement trace on top of a virtual keyboard, you couldn't possibly deduce what was typed? Someone should just make a

• kevingadd 14y ago
  A better question is what degree of danger this information actually poses. It is possible to reverse a password hash created by bcrypt regardless of what settings you used. The question is HOW LONG would it take, and whether the cost makes the value of any potential exploit less than zero. If the value is less than zero, the risk is effectively minimal - at least for now. Panic and tarring and feathering of Microsoft's security team is only justified if the risk is severe.
  • jbri 14y ago
    A security issue is a security issue, regardless of how severe it is. If MS had come out and said "We're working on fixing it, but we don't think it's a critical vulnerability" - that would be understandable. What needs to be called out is if they come and say "This isn't an issue at all". If some website was leaking password hashes, would "well the hashes are so strong that this isn't really an issue" be an acceptable response?
  • DuskStar 14y ago
    Yeah, but you still wouldn't want sites making their bcrypt hashes publicly available...
  • wglb 14y ago
    Well, the underlying software uses just this information (x, y position) to translate the movements of the mouse to individua l key events. Since the OS does it, it is not in the same ballpark as stuffing a dictionary down bcrypt's throat. While the risk may not be severe, and not of the scale of tarring let alone feathering, it is a risk that must be addressed. As the article says, We take these risks very seriously.