5 ms·

I'm confused by their logic. Customers are those who are unable to keep one set of servers appropriately secured and unable to mitigate compromises through the

I'm confused by their logic. Customers are those who are unable to keep one set of servers appropriately secured and unable to mitigate compromises through the use of better techniques (eg bcrypt). So the solution is to run a second set of servers. Why would those be any better or differently secured?

michaelhoffman 14y ago
Because this method makes RSA some money?
- Create 14y ago
  sudo apt-get install ssss or sudo port install ssss
olivier1664 14y ago
Maybe it can keep safe weak password from dictionary attack. If a user has "pass" as password, BCrypt do not protect him once the attacker has an hash of its password. Maybe their 2 servers methods prevent that (I'm really not sure)
- rogerbinns 14y ago
  What leads you to believe that bcrypt is susceptible to hashing or rainbow tables? It uses salts and extremely expensive key setup (ie different for each password even if the original plaintext is the same). It is true that if the password is one of the most common such as "pass" or "password" then you'll be to tell if that is the case in a reasonable amount of time. However you could trivially do that testing without going to the lengths of breaking into and compromising systems. All this RSA mechanism does is split the password verification into two halves each with knowledge of about half the information necessary to compromise. In theory compromising one system won't help you - you need to do both. But that doesn't help against the weakest passwords since they can just be tried against the system. There are some good presentations on the bcrypt wikipedia page. Of note is that 1,000 password guesses per second per system is roughly what happens now, and that scrypt is better for some circumstances. By contrast legacy schemes have rates from 10 million to 2 billion per second - even something as modern as WPA has 100,000 guesses per second per system crackers. But back to the original point - a company with weak administration and security practises isn't going to get any better by doing more of it.

michaelhoffman 14y ago

Because this method makes RSA some money?

Create 14y ago
sudo apt-get install ssss or sudo port install ssss

olivier1664 14y ago

Maybe it can keep safe weak password from dictionary attack. If a user has "pass" as password, BCrypt do not protect him once the attacker has an hash of its password. Maybe their 2 servers methods prevent that (I'm really not sure)

rogerbinns 14y ago
What leads you to believe that bcrypt is susceptible to hashing or rainbow tables? It uses salts and extremely expensive key setup (ie different for each password even if the original plaintext is the same). It is true that if the password is one of the most common such as "pass" or "password" then you'll be to tell if that is the case in a reasonable amount of time. However you could trivially do that testing without going to the lengths of breaking into and compromising systems. All this RSA mechanism does is split the password verification into two halves each with knowledge of about half the information necessary to compromise. In theory compromising one system won't help you - you need to do both. But that doesn't help against the weakest passwords since they can just be tried against the system. There are some good presentations on the bcrypt wikipedia page. Of note is that 1,000 password guesses per second per system is roughly what happens now, and that scrypt is better for some circumstances. By contrast legacy schemes have rates from 10 million to 2 billion per second - even something as modern as WPA has 100,000 guesses per second per system crackers. But back to the original point - a company with weak administration and security practises isn't going to get any better by doing more of it.