afreak
Joined 13 years ago
Karma
1,471
Submissions
226
Member since
Jan 23
Recent submissions
Comment · 10 years ago
Unless you have access to a mobile phone's baseband source code, you cannot really trust anything about its level of security.
This was discussed on HN a while back and comes up quite often:
Comment · 10 years ago
(ignore what I said here)
Comment · 10 years ago
Not the best link but here's something to chew on:
http://www.universetoday.com/15403/how-long-would-it-take-to...
>However, despite these advantages in fuel-efficiency and specific impulse, the most sophisticated NTP concept has a maximum specific impulse of 5000 seconds (50 kN·s/kg). Using nuclear engines driven by fission or fusion, NASA scientists estimate it would could take a spaceship only 90 days to get to Mars when the planet was at “opposition” – i.e. as close as 55,000,000 km from Earth.
> But adjusted for a one-way journey to Proxima Centauri, a nuclear rocket would still take centuries to accelerate to the point where it was flying a fraction of the speed of light. It would then require several decades of travel time, followed by many more centuries of deceleration before reaching it destination. All told, were still talking about 1000 years before it reaches its destination. Good for interplanetary missions, not so good for interstellar ones.
There's talk of other drive systems being able to pull it off but this is the only one that actually has been tested but never built to scale.
Comment · 10 years ago
Keep in mind that at best it would take maybe 1,000 years with current technology to get there with a probe or human-supporting ship. It would be highly unpopular however as it involves exploding nuclear bombs behind the craft to get it there that fast--that and it would probably cost trillions to build the thing.
Comment · 10 years ago
You're assuming that they have a vested interest in holding their Bitcoins for some greater good.
Comment · 10 years ago
PBKDF2 is not for password storage.
Comment · 10 years ago
If the server had bcrypt configured to take a second per password, multiple everything by 4. And so on. What I think is needed as a supplement to "use bcrypt / scrypt" is a "and use it this way so you don't accidentally open your server to DoSing or give a poor experience", because a 10 seconds-to-compute-on-a-Xeon hash is great from a security standpoint if your hashes get leaked, it sucks from a user experience to have to wait at least 10 seconds to login, and if you have to service multiple logins at once your server's not going to be able to do anything else if you just use bcrypt/scrypt synchronously.
If you're in a situation where you're needing to rely on hashing a user's password for every action, your application has far worse problems than what password storage method is in play. Moving from your current password storage method that is inadequate to one that would be better also takes into account that you haven't done something completely wrong with session states.
[edit]
I misread the poster I was responding to assuming that they meant that the user was re-authenticating on each request. My thought process was that if they're storing credentials in a cookie in lieu of a session ID then that needed to be addressed first before even going down the avenue of correcting password storage.
Comment · 10 years ago
As part of a presentation I did at a local OWASP chapter, here are some numbers based on just using CPython's Hashlib processing of 14,000,000 someodd passwords:
Intel Xeon E5-1620 3.6 GHz: SHA: 8.16 seconds, SHA256: 11.01 seconds, MD5: 8.7 seconds
AMD FX-8320 3.5 GHz: SHA: 10.63 seconds, SHA256: 13.49 seconds, MD5: 10.06 second
Intel Celeron N2840 2.2 GHz: SHA: 32.4 seconds, SHA256: 39.75 seconds, MD5: 28.95 seconds
Intel Pentium M 1.7 GHz: SHA: 37.98 seconds, SHA256: 48.12 seconds, MD5: 34.49 seconds
SHA512 isn't going to make it much better.
Comment · 10 years ago
A weak password is a weak password no matter how good the hashing is. I think that you're referring to this bit from last year:
http://www.pxdojo.net/2015/08/what-i-learned-from-cracking-4...
The author of this piece was doing about 156 hashes per second and after just over five days, he had only gone through and cracked 4,000 account passwords--we're talking 0.0001% of Ashley Madison's supposed userbase here. To run just over the 14,000,000 passwords from RockYou.txt on every single user account from AM, it would take up to at least two billion years.
Comment · 10 years ago
No. You cannot effectively use the techniques you can use against SHA/MD5 to attack the three I mentioned.
SHA and MD5 can be calculated entirely in a CPU's registers without having to rely on RAM. Bcrypt for example requires the use of a matrix as part of its calculation, slowing down the process. A GPU has so few channels from the processor to memory that it cannot be effectively done in parallel.
All one has to do with Bcrypt is just adjust the difficulty and any advances in GPU technology or whatever can be nullified.
Comment · 10 years ago
There are several services (including one run by me).
https://canar.io (mine)
Mine lets you free-form search whereas HaveIBeenPwned is there for searching just e-mail addresses.
https://cariad.keigher.ca