Top all-time · #201
Coda Hale
Personal blog · codahale.comsecurityprogramming
Coda Hale's personal blog at codahale.com covers security and programming. Since 2009, 218 different Hacker News readers have linked it 273 times, most often “How To Safely Store A Password”. No feed was found, so read it on the site itself.
Sometimes recommended · 9 of 40 sampled comments recommend it?
Why HN links it
HN readers link Coda Hale's posts mainly for password storage advice (bcrypt, with salts and slow hashes), and also cite them on the CAP theorem, timing attacks and organisational work.
- Recommended for · 9 comments
- Called 'amazingly pragmatic', 'a great post', 'excellent' and 'convincing'; told readers to read it in full.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- How To Safely Store A Password89 people · 117 mentions · first linked 2010-01-31
- You Can't Sacrifice Partition Tolerance16 people · 20 mentions · first linked 2010-10-07
- A Lesson In Timing Attacks (or, Don't use MessageDigest.isEquals)14 people · 15 mentions · first linked 2009-08-13
- Work is work, in which returns diminish (2020)14 people · 14 mentions · first linked 2020-01-12
- Work Is Work13 people · 15 mentions · first linked 2020-01-12
- You Can’t Sacrifice Partition Tolerance (2010)11 people · 11 mentions · first linked 2016-05-15
- A Lesson in Timing Attacks (or, Don’t Use MessageDigest.isEquals)10 people · 10 mentions · first linked 2016-08-12
- How To Safely Store A Password (2010)9 people · 9 mentions · first linked 2016-03-10
- The Rest of the Story (Yammer & Scala)5 people · 6 mentions · first linked 2011-11-30
- The Joy of Duplexes5 people · 5 mentions · first linked 2022-04-03
What Hacker News says?
I understand what he's saying. It's marketing. There's nothing wrong with saying it's CP, but since we control everything there's extremely rare P. Then he can show availability numbers (which he kinda does). Saying it's "effectively CA" defeats the point of the CAP theorem, which says you have to make tradeoffs. See: https://codahale.com/you-cant-sacrifice-partition-tolerance/
Comment linking /you-cant-sacrifice-partition-tolerance/
on “Introducing Cloud Spanner, a Global Database Service”Submitted How To Safely Store A Password as a story · 325 points
HN discussionhttps://codahale.com/how-to-safely-store-a-password/
Comment linking /how-to-safely-store-a-password/
on “Yahoo discloses hack of 1B accounts”Submitted How To Safely Store A Password as a story · 298 points
HN discussionI'm a developer, not a cryptographer, and like most crypto articles, most of this post is gibberish to me. I really tried to follow it in the beginning, but then I gave up, scrolled to the "what should you use instead", and then realized I didn't understand that either. If this is article is "easy" crypto, and I shouldn't roll my own crypto, then what should I do? "Just use elliptic curve crypto but make sure you ch…
Comment linking /how-to-safely-store-a-password/
on “RSA is a fragile cryptosystem”Submitted Work is work, in which returns diminish (2020) as a story · 227 points
HN discussionRight, but if the salt varies per user, then you end up doing a bruteforce on each user's password; it's no longer a precomputation attack. There are no "Rainbow tables" in this case. However, if you find Hale's bcrypt page ( http://codahale.com/how-to-safely-store-a-password/ ) convincing, and I do, salting really doesn't matter because with modern GPUs you can bruteforce a reasonably-sized alphanumeric password, i…
Comment linking /how-to-safely-store-a-password/
on “The FBI stole an Instapaper server in an unrelated raid”Submitted The Rest of the Story (Yammer & Scala) as a story · 198 points
HN discussion... Which is pretty much what bcrypt is. http://codahale.com/how-to-safely-store-a-password/
Comment linking /how-to-safely-store-a-password/
on “The FBI stole an Instapaper server in an unrelated raid”Submitted How To Safely Store A Password as a story · 173 points
HN discussionhttp://codahale.com/how-to-safely-store-a-password/ (Be prepared for your comment score to visit the grey depths if you attempt to relitigate Coda's blog post here and don't know exactly what you're talking about.)
Comment linking /how-to-safely-store-a-password/
on “The FBI stole an Instapaper server in an unrelated raid”Submitted Work Is Work as a story · 153 points
HN discussionUnbelievable/insulting they used a general purpose, easily reversible hash like SHA1 in the first place. I would have thought everyone had seen the 'use bcrypt' page by now. http://codahale.com/how-to-safely-store-a-password/
Comment linking /how-to-safely-store-a-password/
on “6.5 Million LinkedIn Password Hashes Leaked”Submitted You Can't Sacrifice Partition Tolerance as a story · 136 points
HN discussionSo LinkedIn... Why are you not using bcrypt to has your passwords? http://codahale.com/how-to-safely-store-a-password/
Comment linking /how-to-safely-store-a-password/
on “6.5 Million LinkedIn Password Hashes Leaked”Submitted Fan-In as a story · 133 points
HN discussionBcrypt does not require your understanding. The most important thing is that you use a strong password hashing method -- of which bcrypt is the best-known, and an excellent choice. For a basic level of understanding, here's a slightly exasperated blog post that a lot of people link to: http://codahale.com/how-to-safely-store-a-password/
Comment linking /how-to-safely-store-a-password/
on “6.5 Million LinkedIn Password Hashes Leaked”Submitted A Lesson In Timing Attacks (or, Don't use MessageDigest.isEquals) as a story · 113 points
HN discussionhttp://codahale.com/how-to-safely-store-a-password/
Comment linking /how-to-safely-store-a-password/
on “6.5 Million LinkedIn Password Hashes Leaked”Submitted Little’s Law, the Universal Scalability Law, and the Usl4j Java library as a story · 109 points
HN discussionI agree, but my point is that the "use bcrypt" drum has only been beating for a couple years to my knowledge: http://codahale.com/how-to-safely-store-a-password/ Wind the clock back 3-5 years and it's still stupid to use MD5. I could kind of understand some old code laying around that was less secure.
Comment linking /how-to-safely-store-a-password/
on “6.5 Million LinkedIn Password Hashes Leaked”Submitted You Can’t Sacrifice Partition Tolerance (2010) as a story · 93 points
HN discussionThe solution is to use a better method of storing passwords. Hashes like SHA1 are designed to be really fast (great for hashing data but also great if you want to brute force). I think this is a pretty good overview: http://codahale.com/how-to-safely-store-a-password/
Comment linking /how-to-safely-store-a-password/
on “6.5 Million LinkedIn Password Hashes Leaked”Submitted How To Safely Store A Password (2010) as a story · 93 points
HN discussionSpread this in your org, it's amazingly pragmatic and eye opening: https://codahale.com/work-is-work/
Comment linking /work-is-work/
on “The work-from-home future is destroying bosses' brains”Submitted A lesson in timing attacks as a story · 77 points
HN discussionIt's a huge field, basically distributed computing, burdened here with the glorious purpose of durable data storage. Any introductory text long enough becomes essentially a university-level computer science course. RADOS is the underlying storage protocol used by Ceph ( https://ceph.com/ ). Ceph is a distributed POSIX-compliant (very few exceptions) filesystem project that along the way implemented simpler things su…
Comment linking /you-cant-sacrifice-partition-tolerance/
on “Garage: Open-Source Distributed Object Storage”Submitted Towards a Safer Footgun as a story · 62 points
HN discussionAlso relevant: https://codahale.com/work-is-work/
Comment linking /work-is-work/
on “Why is everything so hard in a large organization?”Submitted A Small, Nice Thing as a story · 50 points
HN discussion
