3 ms·
> [...] and can probably avoid the need for passwords altogether. Probably, yeah... In the case they only have read access to the token DB, and need write acc
by pygy_ 14y ago
> [...] and can probably avoid the need for passwords altogether.
Probably, yeah...
In the case they only have read access to the token DB, and need write access, or read access to another part of the system, it becomes an attack vector.
It is not a cargo-cult measure, and it doesn't add much complexity (just re-use your password encoding logic).
The same goes for session tokens, BTW.
> [...] nor would I ever recommend that they do it.
Maybe you should reconsider that. I know who you are, and how knowledgeable and experienced you are, but in this case I think you're just wrong.
- tptacek 14y agoI have never, ever, ever, ever seen an application one-way hash their reset tokens to prevent disclosure of them from their database. That's all I'm going to say here.
- pygy_ 14y agohttp://en.wikipedia.org/wiki/Argumentum_ad_populum http://en.wikipedia.org/wiki/Argumentum_ad_populum A cargo cult is not an argument.
- tptacek 14y agoWhat I'll argue is that it's not a best practice, because nobody practices it. I also think it's a silly countermeasure, but I don't feel like I need to defend that argument. I would not hash reset tokens, but I didn't downmod you for suggesting it. I would get mad at you if you worked on my team and dinged a client for not doing it, though. :)
- pygy_ 14y ago> What I'll argue is that it's not a best practice, because nobody practices it. And now you're begging the question! Actually, some people use it :-). It shuts down an attack vector, and it's cheap to implement. Why is it silly? My rule of thumb is to treat all passwords equivalents in the same way. I'm honestly surprised by your hostility towards the idea (not mine, BTW), and by the downvotes for promoting a strategy that provably (in the math sense) increases security.
- tptacek 14y agoName one. You don't count.
- pygy_ 14y agoHere's where I read about it: http://stackoverflow.com/questions/549/the-definitive-guide-to-forms-based-website-authentication http://stackoverflow.com/questions/549/the-definitive-guide-... Edit: Even if it were just me, it doesn't make the argument invalid. Your arguments so far are 1) it's unlikely to be the weakest link. Textbook case of Murphy's law, 2) nobody does it, and 3) I've never recommended it, therefore it's useless. I don't understand how you can resort to that... Seriously, I'm at loss here. Are you waiting for a high profile attack to react? I know you have a reputation to defend, but I think you screwed it somehow in this case. At least, it proves you're not a machine :-)
- tptacek 14y agoI am having trouble coming up with the attack that dumps the password token table but doesn't give up the whole app. Sorry.
- wglb 14y agoWhat attack does bcrypting this CSRNG-generated number prevent?
- pygy_ 14y agoPrevent someone who gets read access to the token DB from either highjacking sessions or resetting passwords.