Top all-time · #9163
Patrick on Life
Personal blog · throwingfire.com/securitysecurity
Patrick on Life is a personal blog at throwingfire.com about security. Since 2011, 8 different Hacker News readers have linked it 17 times. The last post was in 2017, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Patrick on Life's posts on password storage: md5crypt, salted password hashing, and PwdHash. Comments discuss bcrypt, salting, key stretching, and master-password attacks.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- /storing-passwords-securely/2 people · 2 mentions · first linked 2012-06-08
- /storing-passwords-securely/?utm_source=feedburner&2 people · 2 mentions · first linked 2012-06-07
What Hacker News says?
bcrypt in and of itself already uses multiple runs to make it expensive in terms of CPU time to reproduce a given password. Moreover, salts are precisely designed to help against rainbow table attacks by making it infeasible to create rainbow tables including the large number of salts that you tag onto the end of a given password. bcrypt includes a salt as part of its core. So no, if your scheme is “simply” bcrypt(p…
Comment linking /storing-passwords-securely/
on “Md5crypt is no longer strong enough”Submitted LastPass Disclosure Shows Why We Can't Have Nice Things as a story · 559 points
HN discussionBLAKE2 is a very good alternative if you want software performance: https://blake2.net/ . Just stop what you're doing and look at scrypt, bcrypt or even PBKDF2-HMAC-SHA512 if you're thinking something that involves the words "passwords" and "fast hash function." ( http://throwingfire.com/storing-passwords-securely/#notpassw... )
Comment linking /storing-passwords-securely/
on “Lifetimes of cryptographic hash functions”- pw · 2012-06-06
Submitted Storing Passwords Securely as a story · 250 points
HN discussion You shouldn't be using any of the functions on that page directly, anyway: http://throwingfire.com/storing-passwords-securely/#notpassw...
Comment linking /storing-passwords-securely/
on “Lifetimes of cryptographic hash functions”Submitted Security Through Obscurity as a story · 43 points
HN discussionhttp://throwingfire.com/storing-passwords-securely/#notpassw... http://codahale.com/how-to-safely-store-a-password/
Comment linking /storing-passwords-securely/
on “OVH Security Incident”Submitted Cryptographic Hash Functions Are Not Password Hash Functions as a story · 8 points
HN discussionYes, the scrypt package's PasswordHash API is great, akin to bcrypt ( http://hackage.haskell.org/packages/archive/bcrypt/0.0.4/doc... ). Just ignore the terminology used ("encryptPassword", "password encryption", etc.) Why: http://throwingfire.com/storing-passwords-securely/#notpassw...
Comment linking /storing-passwords-securely/
on “Hulk: A Haskell IRC server”Submitted The history of password security as a story · 5 points
HN discussionIt's using sha256, which is far too fast. Key stretching is essential, especially when something as fast as a digest function like the SHA family is used. PBKDF2, as the article points out, can be used to increase the cost of brute forcing, but bcrypt should be considered before opting for PBKDF + SHA. An article [1] that appeared on HN last month (comments:[2]) also explains why just using hashing with a quick dige…
Comment linking /storing-passwords-securely/?utm_source=feedburner&
on “Salted Password Hashing - Doing it Right”Submitted Gambling with Secrets: an Introduction to Cryptography as a story · 2 points
HN discussionWell, the relevant search space when reversing a hash is the space of original passwords, and you do have to remember your master password. The attack to worry about with these systems is a website taking your generated password and maliciously reversing it to reveal your master password, not that someone will steal your hashed password from a database where it'll have been hashed again and stored securely, and then…
Comment linking /storing-passwords-securely/?utm_source=feedburner&
on “PwdHash”Submitted Implementing Two-Factor Authentication Is Easier Than It Seems as a story · 2 points
HN discussionI agree that by acting smarter they could have limited their exposure, and by limiting their exposure, avoided being hacked so many times (i.e. http://throwingfire.com/security-through-obscurity/ ), but a company as large as Sony really should've gotten their security auditing act together a decade ago. All of the vulnerabilities that were exploited in the past few days were scriptkiddie-things -- SQL injections and…
Comment linking /security-through-obscurity/
on “Sony’s problem is memes, not security”There's virtually no difference between the two. It doesn't matter if you're using the strongest encryption in the world: the system is automated, meaning it has the encryption key in memory so it can validate passwords, the support agents can read them, etc. An attacker doesn't care if it's plain text or if they have to decrypt them with an encryption key that's easily accessible to them. If, instead, they were usi…
Comment linking /storing-passwords-securely/
on “Virgin Media - Your plain text passwords are safe with us”Related: http://throwingfire.com/storing-passwords-securely/#notpassw...
Comment linking /storing-passwords-securely/
on “How to safely store a password (2010)”