4 ms·

people actually pay you just to make shit up?

• sk5t 13y ago
  I can't disagree with your sentiment... there comes a point where a hardware security module makes more sense than extraordinarily convoluted, tortured concealment of the salt and hashing mechanism.
  • floody-berry 13y ago
    It was perhaps unnecessarily blunt, but that is the root problem with most of these leaks: Someone who doesn't know what they're doing implementing a scheme that is only slightly more secure than storing the passwords in plaintext. It turns out LivingSocial was actually using SHA-1 with a 40 byte salt [1]. > LivingSocial never stores passwords in plain text. LivingSocial passwords were hashed with SHA1 using a random 40 byte salt. What this means is that our system took the passwords entered by customers and used an algorithm to change them into a unique data string (essentially creating a unique data fingerprint) – that’s the “hash”. To add an additional layer of protection, the “salt” elongates the password and adds complexity. We have switched our hashing algorithm from SHA1 to bcrypt. A 40 byte salt? "_additional_ layer of protection"? "elongates the password"? It's clear they thought they were implementing extra security (hey, let's use a 40 byte salt instead of 16, mega protection!) but failed miserably because they did not know what they were trying to combat. [1] https://www.livingsocial.com/createpassword https://www.livingsocial.com/createpassword
• eksith 13y ago
  Yes, actually. And to be more civilized when I disagree with them. Edit: My standard response http://eksith.wordpress.com/2013/04/08/diy-hashing-if-you-must/ http://eksith.wordpress.com/2013/04/08/diy-hashing-if-you-mu...