4 ms·

because how the passwords are stored affects whether they are recoverable. are you dense?

by joshu 12y ago

mkal_tsr 12y ago
He asked a simple question, what's with the hostility of asking if he's "dense" ?
- joshu 12y ago
  It's not hostile. It's like he cannot fathom why someone might want to know the thing that they are asking.
  - dchest 12y ago
    Well, I'd like to know what scheme they used too, however this is only because of curiosity and my interest in this topic. Some people seem to need (or even demand by law) to know the scheme, because they see it as a way to assess their security, however they fail to provide a satisfying answer on why exactly they need this knowledge (even when they are told to change passwords!), and how this will change their assessment. I probably need to structure my questions like 5 Whys (https://en.wikipedia.org/wiki/5_Whys https://en.wikipedia.org/wiki/5_Whys), providing the first few answers myself: Q. We need to know the exact password hashing/encryption/storage scheme eBay used. 1. Why? - We need to know if the passwords are easily recoverable. 2. Why? - We need to assess our risks. 3. Why? - ...
dchest 12y ago
That's not an actionable information. There is no reason not to change password and not use different passwords for different websites even if they use yescrypt* with 2 TB ROM. *) https://password-hashing.net/candidates.html https://password-hashing.net/candidates.html
- joshu 12y ago
  If they were someone who used the same password everywhere, then if the password was recoverable, they need to change the password everywhere. Not the brightest password strategy but a valid question.
  - dchest 12y ago
    They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing. (Remember that eBay asked users to change passwords?) But even so, the knowledge of password storage scheme in this case is actually harmful! Suppose Alice is reusing passwords, like you said. She learns that eBay used bcrypt, and due to this knowledge thinks her password is safe, and doesn't change her password anywhere apart from eBay. Good? Nope.
    - hackinthebochs 12y ago
      >They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing I don't see why you keep saying this. These sorts of one-size-fits-all responses to security is why the state of security to day is so bad. A salted hash in itself is useless if you can't decrypt it. If their hashing technique was properly implemented then a good password will be impossible to decrypt. In this scenario there is no reason to change your password. Personally, the value of an easy to remember password is higher than the miniscule risk of it being decrypted and used for nefarious purposes (which is limited by the fact that nothing of importance is linked to this particular password). I probably won't be changing my ebay password.
      - dchest 12y ago
        No, good password is infeasible to brute-force (not "decrypt", hashing doesn't encrypt anything; I invite you to research the topic you're talking about) even if you use non-salted SHA-1. Slow password hashing is there to protect weak passwords. In the event compromise like this, you need to change password regardless, because you can't be certain if, for example, attackers had access to server memory (remember that password is kept there before hashing?) or not. These sorts of one-size-fits-all responses to security is why the state of security to day is so bad. This sentence is completely false.

because how the passwords are stored affects whether they are recoverable. are you dense?

by joshu 12y ago

because how the passwords are stored affects whether they are recoverable. are you dense?

mkal_tsr 12y ago

He asked a simple question, what's with the hostility of asking if he's "dense" ?

joshu 12y ago
It's not hostile. It's like he cannot fathom why someone might want to know the thing that they are asking.
- dchest 12y ago
  Well, I'd like to know what scheme they used too, however this is only because of curiosity and my interest in this topic. Some people seem to need (or even demand by law) to know the scheme, because they see it as a way to assess their security, however they fail to provide a satisfying answer on why exactly they need this knowledge (even when they are told to change passwords!), and how this will change their assessment. I probably need to structure my questions like 5 Whys (https://en.wikipedia.org/wiki/5_Whys https://en.wikipedia.org/wiki/5_Whys), providing the first few answers myself: Q. We need to know the exact password hashing/encryption/storage scheme eBay used. 1. Why? - We need to know if the passwords are easily recoverable. 2. Why? - We need to assess our risks. 3. Why? - ...

dchest 12y ago

That's not an actionable information. There is no reason not to change password and not use different passwords for different websites even if they use yescrypt* with 2 TB ROM. *) https://password-hashing.net/candidates.html https://password-hashing.net/candidates.html

joshu 12y ago
If they were someone who used the same password everywhere, then if the password was recoverable, they need to change the password everywhere. Not the brightest password strategy but a valid question.
- dchest 12y ago
  They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing. (Remember that eBay asked users to change passwords?) But even so, the knowledge of password storage scheme in this case is actually harmful! Suppose Alice is reusing passwords, like you said. She learns that eBay used bcrypt, and due to this knowledge thinks her password is safe, and doesn't change her password anywhere apart from eBay. Good? Nope.
  - hackinthebochs 12y ago
    >They still need to change the password everywhere they used it even if eBay used a state-of-the-art password hashing I don't see why you keep saying this. These sorts of one-size-fits-all responses to security is why the state of security to day is so bad. A salted hash in itself is useless if you can't decrypt it. If their hashing technique was properly implemented then a good password will be impossible to decrypt. In this scenario there is no reason to change your password. Personally, the value of an easy to remember password is higher than the miniscule risk of it being decrypted and used for nefarious purposes (which is limited by the fact that nothing of importance is linked to this particular password). I probably won't be changing my ebay password.
    - dchest 12y ago
      No, good password is infeasible to brute-force (not "decrypt", hashing doesn't encrypt anything; I invite you to research the topic you're talking about) even if you use non-salted SHA-1. Slow password hashing is there to protect weak passwords. In the event compromise like this, you need to change password regardless, because you can't be certain if, for example, attackers had access to server memory (remember that password is kept there before hashing?) or not. These sorts of one-size-fits-all responses to security is why the state of security to day is so bad. This sentence is completely false.