3 ms·
Did this jump out to anyone else? 2. After the data has been downloaded and parsed, an automated system checks each one of them against the Facebook internal d
by fabulist 12y ago
Did this jump out to anyone else?
2. After the data has been downloaded and parsed, an automated system checks each one of them against the Facebook internal databases to see if any of the email addresses and hashed passwords match valid login information on Facebook. We hash each password using our _internal password hashing algorithm_ and the unique salt for that person. Since Facebook stores passwords securely as hashes, we can't simply compare a password directly to the database. We need to hash it first and compare the hashes.
This seems to imply Facebook is rolling their own cryptography...
Its also very self-serving of them to recommend Facebook Login without even mentioning OpenID. Facebook Login in no way improves the security of your Facebook account, in fact I'd argue its likely to do the opposite due to phishing etc. It seems pretty transparent they're pushing an agenda in the guise of security advise, here.
- ryan-c 12y agoThey may just not want to disclose what they're using.
- consideranon 12y agoIf you base your security on obscurity, you're gonna have a bad time.
- cheepin 12y agoEver since my College Operating System's class, I've heard this line misunderstood time and time again. The real security principle here is "Principle of Least Privilege", not "Security through Obscurity". Facebook (I hope) isn't relying on some horrible security system to protect their users in the hope that no one guesses what it is. More likely, they are just hiding information that unprivileged users don't need to know. Maybe they rolled their own, maybe they are using someone else's technology, but they certainly have no obligation to their users to spell out exactly how they handle their logins.
- ryan-c 12y agoSecurity works best when it is like an onion - layered. Tweaking a password hashing algorithm (for example, changing the initialization constant in bcrypt) does not hurt security, and means that the attacker will not have sufficient information to crack the passwords with just a database dump, and even if they have everything a work factor should still deter cracking. Using md5 with the output xored against a constant would not, however, do much good.
- deleted 12y ago[deleted]
- limpon 12y agoAre there any downsides to disclosing the hashing algorithm they're using? Does a hacker have an advantage by knowing this information.
- williamcotton 12y agoI'm going to guess that they're referring to something like: HASHED_SALTED_PASSWORD = BCRYPT(PASSWORD, SALT) SALT_AND_PEPPERED_PASSWORD = HMAC-SHA256(SECRET_FACEBOOK_HASHING_KEY, HASHED_SALTED_PASSWORD) BTW, this is not an example of "security through obscurity".