5 ms·

>(EDIT: Still in process of reading links.) Sorry, I'll try to stop incessantly editing ;-) > Any better? No. General purpose cryptographic hash functions a

>(EDIT: Still in process of reading links.) Sorry, I'll try to stop incessantly editing ;-) > Any better? No. General purpose cryptographic hash functions are designed to be incredibly fast. http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/haswell-cryptographic-performance-paper.pdf http://www.intel.com/content/dam/www/public/us/en/documents/... But convince yourself. Do you have Ruby? http://pastebin.com/zjLiYt2j http://pastebin.com/zjLiYt2j If I bump up your password scheme by 4 orders of magnitude it's still under <.06 seconds on my machine. And that's with a ridiculously inefficient password generator I banged up in ten seconds. Use bcrypt. Use scrypt. Use PBKDF2. Don't roll your own password stretching function, it's a recipe for disaster.

aerovistae 12y ago
Thanks very much, all very clear now. I'll try to persuade the people who have a say in the matter...it's tricky when you're not really an expert yourself so you can't fully explain the matter to a perfect extent, and you're stuck saying "but people on the internet said..."
- sarciszewski 12y ago
  If you mention Thomas Ptacek of Matasano Security (that's who tptacek is), they might be more inclined to listen. Sadly, my name is of little value and if they had heard of it, they'd probably assume malicious intent.
- owenmarshall 12y ago
  Half the problem is that quite a few standards/compliance groups don't impose the right requirements. PCI audits used to just check for "encrypted passwords." OWASP does make a decent recommendation, maybe that'll help give you a leg to stand on: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Impose_infeasible_verification_on_attacker https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet...
  - Alupis 12y ago
    > PCI audits used to just check for "encrypted passwords. PCI is a joke. The self-fill audit: "Are you secure?" -- Uh... sure? The various scanning companies are of differing quality too, adding to the difficulty in getting any real security improvements from the standard across all ecommerce shops.
    - sarciszewski 12y ago
      AFAIK, PCI is an unfunny joke. This is why my pentester friends have told me about it: > Release v1.0 of super cool app. > v1.0 gets PCI certified > Someone discloses a vuln in v1.0 > Release v1.1 > Companies are stuck with v1.0 for at least 90 days until v1.1 can be certified

aerovistae 12y ago

Thanks very much, all very clear now. I'll try to persuade the people who have a say in the matter...it's tricky when you're not really an expert yourself so you can't fully explain the matter to a perfect extent, and you're stuck saying "but people on the internet said..."

sarciszewski 12y ago
If you mention Thomas Ptacek of Matasano Security (that's who tptacek is), they might be more inclined to listen. Sadly, my name is of little value and if they had heard of it, they'd probably assume malicious intent.
owenmarshall 12y ago
Half the problem is that quite a few standards/compliance groups don't impose the right requirements. PCI audits used to just check for "encrypted passwords." OWASP does make a decent recommendation, maybe that'll help give you a leg to stand on: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Impose_infeasible_verification_on_attacker https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet...
- Alupis 12y ago
  > PCI audits used to just check for "encrypted passwords. PCI is a joke. The self-fill audit: "Are you secure?" -- Uh... sure? The various scanning companies are of differing quality too, adding to the difficulty in getting any real security improvements from the standard across all ecommerce shops.
  - sarciszewski 12y ago
    AFAIK, PCI is an unfunny joke. This is why my pentester friends have told me about it: > Release v1.0 of super cool app. > v1.0 gets PCI certified > Someone discloses a vuln in v1.0 > Release v1.1 > Companies are stuck with v1.0 for at least 90 days until v1.1 can be certified