3 ms·

Incorrect. You can't login with a password hash, you need a password.

SideburnsOfDoom 12y ago
No kidding. That's why I put (some) users. Because brute-forcing the hashes will give you some password plain texts. I guess that I missed a step in the explanation where you attack the hashes. However I see that they say that they are using some best practices (bcrypt, "salt per-password") so this attack will be largely mitigated.
fennecfoxen 12y ago
If you get the user table, you can crack the password hashes offline, at your leisure.
- rifung 12y ago
  While technically true, this seems like it would be computationally infeasible, or at least impractical, given that they were not just hashing but also salting the passwords. Of course, I barely know anything about computer security, but at least it should prevent attacks using rainbow tables I think?
  - MichaelGG 12y ago
    No, a simple password like "slack123" should be easy to crack with any usable password storage method.
    - coldcode 12y ago
      With a separate salt for each password not even the NSA can crack that (that we know of). With a single salt for all of them, maybe.
      - nevir 12y ago
        Sure they can. Anyone can. It just takes a long time per password to crack (that time is a function of the cost/# of rounds of the hashing function).
    - nevir 12y ago
      Not necessarily easy. If they're using a decently high cost for their use of bcrypt, we're talking hours to days (or more) per user, even when only considering weak passwords like that.
    - rifung 12y ago
      True, I guess it's possible to crack a password for a single user, especially one with a weak password. I was more thinking that it's unlikely they'll be able to crack the passwords of everyone who was in their database, and given that Slack has so many users it's unlikely for any single person that his/her password will be cracked. Of course, even if they can't steal everyone's passwords, maybe the hackers will try to crack the passwords of higher profile targets.
      - nitrogen 12y ago
        GPUs are fast enough to crack a very large percentage of passwords in a short time by brute force, if a simple algorithm was used, even with salt.
Kalium 12y ago
Depends on the nuances of the system. If you can pass-the-hash, you can get in.

No kidding. That's why I put (some) users. Because brute-forcing the hashes will give you some password plain texts. I guess that I missed a step in the explanation where you attack the hashes. However I see that they say that they are using some best practices (bcrypt, "salt per-password") so this attack will be largely mitigated.

fennecfoxen 12y ago

If you get the user table, you can crack the password hashes offline, at your leisure.

rifung 12y ago
While technically true, this seems like it would be computationally infeasible, or at least impractical, given that they were not just hashing but also salting the passwords. Of course, I barely know anything about computer security, but at least it should prevent attacks using rainbow tables I think?
- MichaelGG 12y ago
  No, a simple password like "slack123" should be easy to crack with any usable password storage method.
  - coldcode 12y ago
    With a separate salt for each password not even the NSA can crack that (that we know of). With a single salt for all of them, maybe.
    - nevir 12y ago
      Sure they can. Anyone can. It just takes a long time per password to crack (that time is a function of the cost/# of rounds of the hashing function).
  - nevir 12y ago
    Not necessarily easy. If they're using a decently high cost for their use of bcrypt, we're talking hours to days (or more) per user, even when only considering weak passwords like that.
  - rifung 12y ago
    True, I guess it's possible to crack a password for a single user, especially one with a weak password. I was more thinking that it's unlikely they'll be able to crack the passwords of everyone who was in their database, and given that Slack has so many users it's unlikely for any single person that his/her password will be cracked. Of course, even if they can't steal everyone's passwords, maybe the hackers will try to crack the passwords of higher profile targets.
    - nitrogen 12y ago
      GPUs are fast enough to crack a very large percentage of passwords in a short time by brute force, if a simple algorithm was used, even with salt.

Kalium 12y ago

Depends on the nuances of the system. If you can pass-the-hash, you can get in.