Top all-time · #902
Anthony Ferrara
Personal blog · blog.ircmaxell.comprogrammingsecurity
Anthony Ferrara writes ircmaxell's Blog, a personal blog at blog.ircmaxell.com about programming and security. Since 2011, 75 different Hacker News readers have linked it 111 times, most often “Why I Don't Recommend Scrypt (2014)”. The last post was in 2021, but the archive is still widely read.
Rarely recommended · 3 of 37 sampled comments recommend it?
Why HN links it
HN readers link this author's security posts on password hashing (scrypt, bcrypt, peppering), timing attacks and PHP. Commenters often cite them as the reference for these topics.
Summarised by Claude from a sample of 37 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A blog about PHP, Security, Performance and general web application development.
Most-linked posts?
- Why I Don't Recommend Scrypt (2014)10 people · 10 mentions · first linked 2014-03-12
- Security Issue: Combining Bcrypt with Other Hash Functions6 people · 7 mentions · first linked 2015-03-12
- It's All About Time – Remote timing attacks in PHP5 people · 5 mentions · first linked 2014-11-28
- Properly Salting Passwords, The Case Against Pepper4 people · 4 mentions · first linked 2012-04-17
- Disclosure: WordPress WPDB SQL Injection3 people · 3 mentions · first linked 2017-10-31
- Anatomy of an Attack: How I Hacked StackOverflow (2012)3 people · 3 mentions · first linked 2012-11-12
- PHP Install Statistics3 people · 3 mentions · first linked 2014-12-30
- Disclosure: WordPress WPDB SQL Injection3 people · 3 mentions · first linked 2017-10-31
- PHP Sucks But I Like It3 people · 3 mentions · first linked 2012-04-10
- Scalar Types and PHP2 people · 2 mentions · first linked 2015-02-11
What Hacker News says?
scrypt is okay if you use it correctly. It's too easy to use it incorrectly, though, because scrypt is a low-level algorithm that wasn't specifically designed for password storage. [1] http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scryp... In order to be able to tell people to "just use scrypt", we would need to have a sort of standard wrapper that uses the correct parameters by default and produces identic…
Comment linking /2014/03/why-i-dont-recommend-scrypt.html
on “Yahoo discloses hack of 1B accounts”Submitted PHP Sucks But I Like It as a story · 326 points
HN discussion> A properly implemented, simple pepper can only help password security and can't hurt it. Well, yes. But what is the definition of "properly"? There are definitely constructions of "pepper" that look simple, but drastically hurt overall security: bcrypt(hmac(password, key), salt) If hmac returns raw bytes, you're in real trouble: http://blog.ircmaxell.com/2015/03/security-issue-combining-b... It's sort of like the…
Comment linking /2015/03/security-issue-combining-bcrypt-with.html
on “Slack was hacked”Submitted Rambling On [PHP] Internals as a story · 184 points
HN discussionIs there any significant evidence that peppering passwords helps? I've seen arguments for and against peppering out on the big bad internet. Everyone has opinions but there are few people's opinions about crypto that I actually trust. The best article I've seen against this technique is by ircmaxell [0]. Nicely summed up in this sentence "It is far better to use standard, proven algorithms then to create your own to…
Comment linking /2012/04/properly-salting-passwords-case-against.html
on “Slack was hacked”Submitted A PHP Compiler, a.k.a. the FFI Rabbit Hole as a story · 139 points
HN discussionI really wish that people would stop referencing that "Fractal of Bad Design" article. It's outdated and mostly irrelevant now (April 2012, PHP was at 5.4 then, it's at 7.2 now). It's not that I want to defend PHP, I just think people should judge PHP for what it is now instead of what it was several major changes ago. Besides, the author seems to misunderstand a great many things about PHP and languages in general.…
Comment linking /2012/04/php-sucks-but-i-like-it.html
on “Many packages suddenly disappeared”Submitted The True Problem With PHP as a story · 85 points
HN discussion> As to preventing timing attacks you can add a delay to give a uniform response time. You have to be very careful with how you implement the delay to prevent the timing signal from still propagating to the attacker. https://blog.ircmaxell.com/2014/11/its-all-about-time.html#A...
Comment linking /2014/11/its-all-about-time.html
on “The Effectiveness of Publicly Shaming Bad Security”Submitted Anatomy of an Attack: How I Hacked StackOverflow (2012) as a story · 83 points
HN discussionTwo years ago, PHP's package manager, Composer, was sped up by disabling the garbage collector: http://blog.ircmaxell.com/2014/12/what-about-garbage.html (Or more accurately the cycle collector. You can't turn off reference counting.)
Comment linking /2014/12/what-about-garbage.html
on “Disabling npm's progress bar yields a 2x npm install speed improvement”Submitted It's All About Time – Remote timing attacks in PHP as a story · 83 points
HN discussionHow to protect from timing attacks - It's All About Time: http://blog.ircmaxell.com/2014/11/its-all-about-time.html
Comment linking /2014/11/its-all-about-time.html
on “We ditched Google Analytics”Submitted PHP Install Statistics as a story · 77 points
HN discussion> I literally don't understand what it is you're getting at. I truly hope this will help then: https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass... "Password hashing" is its own compound noun. The acceptable algorithms (as defined in the blog post this HN thread is about) take care of this for you. > Anyone using 3DES, MD5, or similar is likely vulnerable to timing attacks, and they're definitely still in…
Comment linking /2012/04/properly-salting-passwords-case-against.html
on “How to Safely Store Your Users' Passwords in 2016”Submitted Tries and Lexers as a story · 67 points
HN discussionUdacity has a Networking for Web Developers course[0], but I'd recommend trying out things (such as running a simple web-app on your own server). Things like: - Running https://certbot.eff.org/instructions - Trying out a few different web servers (apache/nginx/caddy) - Playing around with load-balancers on $cloud_provider. - Spending time with docker networking ( https://docs.docker.com/config/containers/container-n…
Comment linking /2012/11/anatomy-of-attack-how-i-hacked.html
on “Ask HN: Good books/courses to learn networking essentials for web developers?”Submitted The Secure Programmer's Pledge as a story · 59 points
HN discussionhttps://git.gnu.io/gnu/gnu-social/blob/master/lib/util.php#L... Oh boy, strcmp() for passwords. http://blog.ircmaxell.com/2014/11/its-all-about-time.html
Comment linking /2014/11/its-all-about-time.html
on “GNU Social, a FLOSS alternative to Twitter”Submitted The Power of Technical Debt as a story · 54 points
HN discussionI've been saying "scrypt, bcrypt, PBKDF2, or bust" for years. Also, there's a large industry trend of, "let's 'pepper' our hashes too!" whereby they have a sitewide salt. This is a mistake. If you want to add a site-specific layer of security to your passwords, encrypting them makes far better sense than adding to the salt. https://github.com/lizardhq/php_bcrypt_aes http://blog.ircmaxell.com/2015/03/security-issue-c…
Comment linking /2015/03/security-issue-combining-bcrypt-with.html
on “Enough with the Salts: Updates on Secure Password Schemes”Submitted OOP vs Procedural Code as a story · 53 points
HN discussionAnd the target response is http://blog.ircmaxell.com/2012/04/php-sucks-but-i-like-it.ht...
Comment linking /2012/04/php-sucks-but-i-like-it.html
on “PHP Addiction”Submitted The MicroPHP Fallacy as a story · 49 points
HN discussionAnthony Ferrara did a rebuttal here: http://blog.ircmaxell.com/2012/04/php-sucks-but-i-like-it.ht... Not a good rebuttal but I've done my own here: http://news.ycombinator.com/item?id=4177516
Comment linking /2012/04/php-sucks-but-i-like-it.html
on “PHP Addiction”Submitted Why I Don't Recommend Scrypt (2014) as a story · 31 points
HN discussionOne concern I have here, is that people are going to perceive this post as "this is what you should do and it's easy!", because the post doesn't really address the complexities of implementing this kind of thing. As a result, we're probably going to have a bunch more issues like this one: http://blog.ircmaxell.com/2015/03/security-issue-combining-b... I'm not looking forward to having to talk people off that particu…
Comment linking /2015/03/security-issue-combining-bcrypt-with.html
on “How Dropbox securely stores your passwords”Submitted Recki-CT: PHP compiler in PHP as a story · 28 points
HN discussionThank you, I looked few pages. Looks like paper is useless most of the time. According by this article http://blog.ircmaxell.com/2012/04/properly-salting-passwords... better solution is encrypt(hash(salt + password))
Comment linking /2012/04/properly-salting-passwords-case-against.html
on “Salted Password Hashing – Doing it Right”Submitted An Open Letter to PHP-FIG by Anthony Ferrara as a story · 21 points
HN discussion
