alecmuffett

7 ms·

31.
by alecmuffett 10y ago
> you also have to authenticate the HMAC-providing service Yes. But, to look at the Facebook approach, what is the risk surface presented by the HMAC service? Done properly in the FB approach the password is irreversibly hashed before it
32.
by alecmuffett 10y ago
tl;dr for me: Putting the authentication service into a nice tidy centralised box does not actually achieve much, and may have architectural downsides. Not the least of which is: if it's wholly in a service, then you have to authentica
33.
by alecmuffett 10y ago
Correct.
34.
by alecmuffett 10y ago
https://video.adm.ntnu.no/pres/54b660049af94
35.
by alecmuffett 10y ago
>Last question first: large, but not Facebook large (I spent 10 years consulting on this kind of thing). I just spent 3 years living it for 50h/week. Hence why I am taking a vacation. >If it's there because that's how p
36.
by alecmuffett 10y ago
>No, according to your talk, Facebook's solution is that password validation is pushed out to the front-end servers, Yes, although I don't work for Facebook any more, that was and probably still is the case. >who use back-en
37.
by alecmuffett 10y ago
Yep, Tom, that's the FB solution - or rather, halfway up the stack of hashing is a callout to a service where HMACs are involved. These bring their own challenges: https://video.adm.ntnu.no/pres/54b660049af94
38.
by alecmuffett 10y ago
Hi! I'm Alec, I presented that Facebook password hashing paper at PasswordCon'15 and the video is here, slides included: https://video.adm.ntnu.no/pres/54b660049af94
39.
by alecmuffett 12y ago
Hi there; I don't know the answer to that question yet, but I will be investigating the matter next week and will take action accordingly. Thank you for the details and for taking the time to do that, it's appreciated.
40.
by alecmuffett 12y ago
Hi, my name's Alec, I work as a software engineer for Facebook. Apologies for what you observed, it was due to an automatic system miscategorising the Tor download site. We've fixed the issue, given our software a stern talking-to
41.
A Venture Capitalist’s Experience of Startups and Security(dropsafe.crypticide.com)
2 points by alecmuffett 14y ago|0 comments
42.
by alecmuffett 14y ago
@laughinghan if you have to ask my suspicion is that no word of mouth will be enough for you, so instead may I recommend: http://en.wikipedia.org/wiki/Ross_J._Anderson http://en.wikipedia.org/wiki/Markus_Kuhn http://en.wikipedia.org/wi