5 ms·

Hashing data with SHA1 should be a criminal offense? Seriously?

• Zenst 14y ago
  partialy in jest but what I mean we often come across sitess that have issues and boils down to unsalted weak security hashing. In that you only find out about such weakness's when things go wrong. Certainly MD5 I'd say less in jest but as for SHA1 and any hashing that is found to have flaws and known about for a while the ongoing use is really down to its working don't touch it. Now if you have a site using say MD5 or SHA1 hashing unsalted and they get attacked and leaked then the attacked can brute force those hash's into plain text. If a site works and uses poor security and is not attacked then what forced them to maintain there security or improve it as it is seemed just to work. Sadly hindsite and reaction to security issues or break ins with password hash tables stolen for many sites is when they do something and that is retrospectively. So in a way a law that forced or even focused site owners to deal with problems before they are problems would only be good for joe publics privacy. Maybe a law or other means are the way, maybe not. But certainly the current situaton and attitude by some managment in companies towards there IT people with regards to them wanting to fix issues that are not obviously an issue now can only but help. I know and I'm sure others have known of situations in IT when the IT people want to do something to fix a potentual problem and yet budgets prevent them as it is not an issue and certainly from my experience of companies that use ITIL or other approaches they bias towards retrospective approach's in contrast to proactive ones. So if it takes a law to focus and support the IT people in companies to enable them to do the right thing then it can only be good.
  • tptacek 14y ago
    The known flaws in MD5 do not damage its security as a password hash. Passwords are a particularly difficult cryptanalytic challenge; you need a preimage attack that works on data constrained to a very small number of blocks.
• harryh 14y ago
  It already is. The FCC regulates this sort of thing. If you are a large business with lots of user data and you don't take appropriate steps to protect it they can and will fine you.
  • tptacek 14y ago
    The FCC has never fined anyone for SHA1-hashing passwords.
    • harryh 14y ago
      I'll take your word for it, but I bet that has to do with the fact that once you get big enough for the FCC to care you probably know enough to properly store a password. They've certainly fined other companies for other transgressions of a similar nature.
      • tptacek 14y ago
        For instance...?
        • harryh 14y ago
          Path just had to pay an 800k fine (though I think that was for coppa violations?). Twitter & Google have also had very prominent investigations & settlements in the past couple of years.
          • dfc 14y ago
            I think tptacek might be using the socratic method or else he is just messing with you but I can't watch it any longer. The regulatory function you are talking about falls under the purview of the FTC, not the FCC. "Path Social Networking App Settles FTC Charges it Deceived Consumers and Improperly Collected Personal Information from Users' Mobile Address Books Company also Will Pay $800,000 for Allegedly Collecting Kids' Personal Information without their Parents’ Consent"[1] [1] http://www.ftc.gov/opa/2013/02/path.shtm http://www.ftc.gov/opa/2013/02/path.shtm
• deleted 14y ago
  [deleted]