6 ms·

"If you registered, logged in or changed your password after January 8th, 2014, your password was converted to be hashed with BCrypt and HMAC using a unique sal

by dewey 13y ago

"If you registered, logged in or changed your password after January 8th, 2014, your password was converted to be hashed with BCrypt and HMAC using a unique salt. Before that, it was salted MD5." Are they saying the passwords were hashed with MD5 before January? Because that'd be a bit scary.

camus2 13y ago
You'd be surprised how much "PHP login" tutorial use md5 for password encryption. And then people are surprised these devs dont known better? it's because of all the mis-eductive content the web cant get rid of.
- krapp 13y ago
  Also, many startups consider security to be a waste of time, since you don't need a secure site to generate revenue (arguably, appearing secure has more value in that sense than actually being secure.) Also I still see people now and then arguing that salted md5 is perfectly secure and that using a slower hash or any hash at all either doesn't add value or actually harms value. So they may not know better, or they may know better and simply not care.
  - balls187 13y ago
    > Also, many startups consider security to be a waste of time Do you have evidence to support this? I wouldn't say that security is considered a waste of time. It is, however is a trade-off[1] between money, time, and other resources, things that, generally speaking, start-ups tend to be short on. I worked for a startup that provided multifactor authentication using biometrics (amongst others), and almost all of our business came after publicized (and not publicized) breaches, from both large and small firms. [1]https://www.schneier.com/essay-155.html https://www.schneier.com/essay-155.html
    - krapp 13y ago
      We may be talking about the same phenomenon from different points of view. I have evidence but I really don't want to name names - but anecdotally, I have pointed out massive issues (like not even escaping user-provided variables in inline SQL queries) to clients, and seen it dismissed as less important than just getting live. Maybe my comment was a bit too biased and hyperbolic, but I've certainly encountered that attitude.
- voltagex_ 13y ago
  I once registered wrongtutorial.com to call out incorrect and dangerous tutorials. I couldn't write enough content to get it off the ground. Do you think it'd still be a good idea?
  - nknighthb 13y ago
    A more general form of tutorial review/correction site would be more interesting. Actually, a browser add-on to load commentary/annotations for known tutorials on the fly might be nice. All sorts of practical problems that would have to be overcome, though (like changing content and getting people to use the add-on in the first place).
  - aaronem 13y ago
    > I couldn't write enough content to get it off the ground. Poke around w3schools. That should give you more than enough initial grist for your mill.
    - id 13y ago
      http://www.w3fools.com/ http://www.w3fools.com/
  - camus2 13y ago
    Definetly! I love this idea!
codecondo 13y ago
It's not scary, it's the truth, and it's bad. But, what can you do?
Dylan16807 13y ago
Salted MD5/SHA is basically the standard even though it's awful, and the flaws in MD5's algorithm don't really apply to the password case.
- tptacek 13y ago
  The flaws in MD5 don't really apply to passwords, but the flaws in salted MD5/SHAx sure do.
KMag 13y ago
It's still a bit scary that they're apparently using some ad-hoc KDF (key derivation function) built from bcrypt and HMAC. bcrypt is a decent KDF, but there are several ways to make a bad KDF from a combination of bcrypt and HMAC. For instance, concatenating bcrypt(salt, pw) and HMAC-SHA512(salt, pw) makes guessing passwords way too fast. I'm hoping that all they've done is use bcrypt(salt, HMAC-SHA256(salt, pw)) to get around the bcrypt 72 character limit. However, using scrypt would have been better.
- nialo 13y ago
  why does concatenating bcrypt(salt, pw) with HMAC(salt, pw) make guessing fast? Intuitively it seems like you'd still need to guess the bcrypt portion, making it no worse than just bcrypt.
  - euank 13y ago
    Why not just ignore the bcrypt portion? "Intuitively" it seems to me like you could just un-concatonate the two strings and guess at them separately, working on whichever you know to be easier.
- reedloden 13y ago
  Hopefully, the 'salt' passed to HMAC-SHA256 is a pepper (preferably stored outside the database), not the same user salt as what bcrypt uses. As for scrypt, it definitely has great potential, but I still feel it's too new and not as well understood to be used 100% correctly in production by most folks (see also http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scryp...).
- azinman2 13y ago
  What's wrong with bcrypt?

by dewey 13y ago

camus2 13y ago

You'd be surprised how much "PHP login" tutorial use md5 for password encryption. And then people are surprised these devs dont known better? it's because of all the mis-eductive content the web cant get rid of.

krapp 13y ago
Also, many startups consider security to be a waste of time, since you don't need a secure site to generate revenue (arguably, appearing secure has more value in that sense than actually being secure.) Also I still see people now and then arguing that salted md5 is perfectly secure and that using a slower hash or any hash at all either doesn't add value or actually harms value. So they may not know better, or they may know better and simply not care.
- balls187 13y ago
  > Also, many startups consider security to be a waste of time Do you have evidence to support this? I wouldn't say that security is considered a waste of time. It is, however is a trade-off[1] between money, time, and other resources, things that, generally speaking, start-ups tend to be short on. I worked for a startup that provided multifactor authentication using biometrics (amongst others), and almost all of our business came after publicized (and not publicized) breaches, from both large and small firms. [1]https://www.schneier.com/essay-155.html https://www.schneier.com/essay-155.html
  - krapp 13y ago
    We may be talking about the same phenomenon from different points of view. I have evidence but I really don't want to name names - but anecdotally, I have pointed out massive issues (like not even escaping user-provided variables in inline SQL queries) to clients, and seen it dismissed as less important than just getting live. Maybe my comment was a bit too biased and hyperbolic, but I've certainly encountered that attitude.
voltagex_ 13y ago
I once registered wrongtutorial.com to call out incorrect and dangerous tutorials. I couldn't write enough content to get it off the ground. Do you think it'd still be a good idea?
- nknighthb 13y ago
  A more general form of tutorial review/correction site would be more interesting. Actually, a browser add-on to load commentary/annotations for known tutorials on the fly might be nice. All sorts of practical problems that would have to be overcome, though (like changing content and getting people to use the add-on in the first place).
- aaronem 13y ago
  > I couldn't write enough content to get it off the ground. Poke around w3schools. That should give you more than enough initial grist for your mill.
  - id 13y ago
    http://www.w3fools.com/ http://www.w3fools.com/
- camus2 13y ago
  Definetly! I love this idea!

codecondo 13y ago

It's not scary, it's the truth, and it's bad. But, what can you do?

Dylan16807 13y ago

Salted MD5/SHA is basically the standard even though it's awful, and the flaws in MD5's algorithm don't really apply to the password case.

tptacek 13y ago
The flaws in MD5 don't really apply to passwords, but the flaws in salted MD5/SHAx sure do.

KMag 13y ago

It's still a bit scary that they're apparently using some ad-hoc KDF (key derivation function) built from bcrypt and HMAC. bcrypt is a decent KDF, but there are several ways to make a bad KDF from a combination of bcrypt and HMAC. For instance, concatenating bcrypt(salt, pw) and HMAC-SHA512(salt, pw) makes guessing passwords way too fast. I'm hoping that all they've done is use bcrypt(salt, HMAC-SHA256(salt, pw)) to get around the bcrypt 72 character limit. However, using scrypt would have been better.

nialo 13y ago
why does concatenating bcrypt(salt, pw) with HMAC(salt, pw) make guessing fast? Intuitively it seems like you'd still need to guess the bcrypt portion, making it no worse than just bcrypt.
- euank 13y ago
  Why not just ignore the bcrypt portion? "Intuitively" it seems to me like you could just un-concatonate the two strings and guess at them separately, working on whichever you know to be easier.
reedloden 13y ago
Hopefully, the 'salt' passed to HMAC-SHA256 is a pepper (preferably stored outside the database), not the same user salt as what bcrypt uses. As for scrypt, it definitely has great potential, but I still feel it's too new and not as well understood to be used 100% correctly in production by most folks (see also http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scryp...).
azinman2 13y ago
What's wrong with bcrypt?