Top all-time · #2567
Ben Adida
Personal blog · benlog.comsecurityculture
Ben Adida writes Benlog, a personal blog at benlog.com about security and culture. Since 2008, 28 different Hacker News readers have linked it 41 times, most often “Don’t Hash Secrets”. It is still writing: the last post was on 2024-11-17, and you can follow it by feed.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
HN readers link Ben Adida's posts on hashing secrets versus password hashing, the Comodo CA hack, encryption, and the Takoma Park voting audit, mostly as cryptography and election-security references.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
technology & people
Most-linked posts?
- Don’t Hash Secrets4 people · 4 mentions · first linked 2010-01-28
- Crypto as in Crypto2 people · 9 mentions · first linked 2018-01-16
- encryption is not gravy2 people · 2 mentions · first linked 2012-04-30
- Don't Hash Secrets (2008)2 people · 2 mentions · first linked 2018-06-13
What Hacker News says?
http://benlog.com/articles/2008/06/19/dont-hash-secrets/
Comment linking /articles/2008/06/19/dont-hash-secrets/
on “AmEx: "We discourage the use of special characters because..."”Submitted The responsibility we have as software engineers as a story · 193 points
HN discussionThere are many things wrong with this article. You can't hash secrets like this because hash functions are iterative. You should be using HMAC. Here's a good explanation http://benlog.com/2008/06/19/dont-hash-secrets/
Comment linking /2008/06/19/dont-hash-secrets/
on “Salted Password Hashing – Doing it Right”Submitted Don’t Hash Secrets as a story · 110 points
HN discussionIt's a commentary on the Comodo hack and the sad state of SSL CAs that led to it: there are too many CAs and their processes are too weak, so what's the harm from one more? http://benlog.com/articles/2011/03/30/intelligently-designin...
Comment linking /articles/2011/03/30/intelligently-designing-trust/
on “Bug 647959 – Add Honest Achmed's root certificate”Submitted Don’t Hash Secrets (2008) as a story · 78 points
HN discussionTo put this in short-hand: "We bank online, we buy all sorts of stuff online, why not vote?" The biggest reason is that banking and other financial transactions have a very different threat model from voting. In particular, voting requires a secret ballot . In addition to preventing an adversary from learning how you voted, a secret ballot requires you to be unable to prove how you voted, to prevent vote selling and…
Comment linking /2007/03/02/on-voting-banking-and-bad-analogies/
on “Detailed audit of Voatz' voting app confirms security flaws”Submitted encryption is not gravy as a story · 61 points
HN discussion> The only solution to a private internet is to fully embrace cryptography for all our communications. Mozilla (or at least the Mozilla employee that wrote the OP) does not believe that: http://benlog.com/articles/2012/04/30/encryption-is-not-grav... Personally, I think that argument is right. "Complete" encryption has usability tradeoffs many people will refuse to make. And I get that. Emotionally, it frustrates me…
Comment linking /articles/2012/04/30/encryption-is-not-gravy/
on “Mozilla Persona and Surveillance”Submitted "If you’re outraged by accidental breaches, you’d better sit down" as a story · 58 points
HN discussionHow does the server verify that the salt it receives in the second request is the same salt it generated in the first response? Does the server have to retain state? Also you should maybe read https://benlog.com/2008/06/19/dont-hash-secrets/
Comment linking /2008/06/19/dont-hash-secrets/
on “A Child’s Garden of Inter-Service Authentication Schemes”Submitted Steve Jobs's slight of hand as a story · 23 points
HN discussionI think the difference between you and tptacek here is basically about this: http://benlog.com/2014/01/03/there-are-3-kinds-of-crypto/ Google has done an enormous amount to improve and deploy what Ben Adida called "b2c crypto" -- typically turning it on months to years ahead of its main competitors, and actively supporting work on making it stronger. But they've done almost nothing to encourage the use of "p2p crypt…
Comment linking /2014/01/03/there-are-3-kinds-of-crypto/
on “You have a moral obligation to use crypto”Submitted Crypto as in Crypto as a story · 18 points
HN discussionBen Adida has been blogging about the election and verification in Takoma Park: http://benlog.com/articles/2009/11/09/takoma-park-verifying-...
Comment linking /articles/2009/11/09/takoma-park-verifying-the-shuffle-and-the-unopened-ballots/
on “Cryptographic voting system developed by MIT prof has first real world trial”Submitted Ben Adida on Dropbox security: "grab the pitchforks… again" as a story · 16 points
HN discussionBut no, you can't re-hash with a new salt without access to the plain-text password. If you could, so could the bad guy :) Yes you can, if you believe this: http://benlog.com/articles/2008/06/19/dont-hash-secrets/ This is exactly why HMAC is more complicated than just: hash(message+secret)
Comment linking /articles/2008/06/19/dont-hash-secrets/
on “Don't hash passwords? I say yes. Hash them And correctly”Submitted Why I’m switching to Yahoo Search as a story · 10 points
HN discussionCheck out Ben Adida's posts about the audit process: http://benlog.com
Comment linking /
on “Maryland Voters Test New Cryptographic Voting System”Submitted Letter to President Obama on Surveillance and Freedom as a story · 4 points
HN discussionSubmitted Crypto as in Crypto (2018) as a story · 3 points
HN discussionSubmitted Crypto as in Crypto (2018) as a story · 2 points
HN discussionSubmitted Crypto as in Crypto (2018) as a story · 2 points
HN discussionSubmitted Crypto as in Crypto (2018) as a story · 2 points
HN discussionSubmitted Don't Hash Secrets (2008) as a story · 2 points
HN discussionSubmitted Security is hard, let’s improve the conversation as a story · 2 points
HN discussionSubmitted Firefox is the Unlocked Browser as a story · 2 points
HN discussionSubmitted With great power… as a story · 2 points
HN discussionSubmitted Facebook, the Control Revolution, and the Failure of Applied Modern Cryptography as a story · 2 points
HN discussionSubmitted Browser extensions = user freedom as a story · 2 points
HN discussion
