4 ms·

PUBLIC SERVICE REQUEST: If the LivingSocial hashes do end up leaking will folks who work on cracking them pretty please record and publish their crack rate as

PUBLIC SERVICE REQUEST: If the LivingSocial hashes do end up leaking will folks who work on cracking them pretty please record and publish their crack rate as it changes as progress is made over the db? We need these kinds of records kept on real-world events in order to do retrospective studies. TIA :-)

dfadfa 14y ago
Yes please do. And then afterwards somebody will be able to use that to incriminate you.
- marshray 14y ago
  Simply cracking hashes that somebody else already leaked shouldn't be a crime and it's a common activity for network defenders and security researchers. Some fundamental concepts used by defenders like "password strength" are subtly dependent upon the abilities of a putative attacker, yet we know that attackers are evolving their skills with every new breach. Thus in order for defenders to reason intelligently about their security and resolve the numerous trade-offs they face, we need data from the widest possible variety of sources when these real-world events occur.
- tptacek 14y ago
  People have been cracking passwords and releasing stats for something like two decades now. Point to one of them who got prosecuted.
  - larrys 14y ago
    Would you agree though that releasing the info might put you on the radar or up your "watch list" karma? I understand your point though. Similar to when I hear people on HN make statements of what could happen in business, with the IRS, or their city government (say with inspections) but from my years of experience I laugh because it is an extremely rare occurrence. "You can't claim the laptop you bought that your wife uses as a business expense if you get audited you are in deep shit!!!"
    - tptacek 14y ago
      No, I really doubt that it would put you on any kind of watch list.
    - marshray 14y ago
      The only radar that matters is the one you put in your own head. Fuck the radar.
- GigabyteCoin 14y ago
  You made this account just to make that comment? I suppose you knew you were in for some downvotes.

dfadfa 14y ago

Yes please do. And then afterwards somebody will be able to use that to incriminate you.

marshray 14y ago
Simply cracking hashes that somebody else already leaked shouldn't be a crime and it's a common activity for network defenders and security researchers. Some fundamental concepts used by defenders like "password strength" are subtly dependent upon the abilities of a putative attacker, yet we know that attackers are evolving their skills with every new breach. Thus in order for defenders to reason intelligently about their security and resolve the numerous trade-offs they face, we need data from the widest possible variety of sources when these real-world events occur.
tptacek 14y ago
People have been cracking passwords and releasing stats for something like two decades now. Point to one of them who got prosecuted.
- larrys 14y ago
  Would you agree though that releasing the info might put you on the radar or up your "watch list" karma? I understand your point though. Similar to when I hear people on HN make statements of what could happen in business, with the IRS, or their city government (say with inspections) but from my years of experience I laugh because it is an extremely rare occurrence. "You can't claim the laptop you bought that your wife uses as a business expense if you get audited you are in deep shit!!!"
  - tptacek 14y ago
    No, I really doubt that it would put you on any kind of watch list.
  - marshray 14y ago
    The only radar that matters is the one you put in your own head. Fuck the radar.
GigabyteCoin 14y ago
You made this account just to make that comment? I suppose you knew you were in for some downvotes.