Re:Weblog.sh – hosted blogging from the command-line
by vruiz on Tuesday November 24, 2015 @07:16AM
(#10620298)
"pathetic" is a bit harsh. Yes, one should be using b/scrypt nowadays but at least he's using salt and sha256 it's not md5. It could be better, but it could also be much worse.
Re:Weblog.sh – hosted blogging from the command-line
by iancarroll on Tuesday November 24, 2015 @08:12AM
(#10620458)
sha256 is not "better" than MD5 for password hashing; they're both incredibly fast to brute force and both not meant for password hashing. bcrypt/scrypt, configured correctly, are much slower and much more secure.
Re:Weblog.sh – hosted blogging from the command-line
by feld on Tuesday November 24, 2015 @09:42AM
(#10620952)
salt adds a minor hurdle and that's it.
Re:Weblog.sh – hosted blogging from the command-line
by TazeTSchnitzel on Tuesday November 24, 2015 @08:21AM
(#10620493)
PHP has an easy-to-use password hashing function with secure defaults right there in the standard library:
This is one idea of PHP's that other languages should copy.
Re:Weblog.sh – hosted blogging from the command-line
by z3t4 on Tuesday November 24, 2015 @09:00AM
(#10620685)
Hashes are generally used to check data integrity ...
When hashing passwords you want a function that is slow and have MANY (but not too many) collisions so that it can not be brute-forced in any direction.
Re:Weblog.sh – hosted blogging from the command-line
by thiht on Tuesday November 24, 2015 @10:42AM
(#10621325)
>have MANY (but not too many) collisions so that it can not be brute-forced in any direction
I don't understand this part? Basically if I'm able to find a collision it's like I found the real password, so why is a function with many collisions better for password hashing? Is there a way to differentiate the collisions?
EDIT: typo
Re:Weblog.sh – hosted blogging from the command-line
by iancarroll on Tuesday November 24, 2015 @12:11PM
(#10622022)
You don't want collisions, as the entire point of a hashing algorithm is to _not_ have collisions. I'm not sure what the OP is talking about.
What you really want for password hashing is a key derivation function, which will generate a random, unique hash slowly.
Re:Weblog.sh – hosted blogging from the command-line
by z3t4 on Tuesday November 24, 2015 @05:46PM
(#10624123)
Lets say someone gains access to the password hashes, he/she can compute hashes until a match is found. And then login to that particular system, but does not know the secret (if there are many collisions, and the pw is random). I'm no expert though, and I assume that if someone gains access to all the password hashes, he/she already has access to the system.
Re:Weblog.sh – hosted blogging from the command-line
by darshanrampatel on Tuesday November 24, 2015 @05:38AM
(#10620073)
Can you explain why this is no good? Just sha256?
Re:Weblog.sh – hosted blogging from the command-line
by iancarroll on Tuesday November 24, 2015 @12:13PM
(#10622035)
SHA256 is a hashing algorithm, which is supposed to be able to create a checksum fast. However, you don't want your passwords to be cracked at a fast speed, so you use a KDF like bcrypt or scrypt, which is much slower and harder to implement on GPUs.
https://github.com/hmngwy/weblog.sh/blob/master/lib/ssh/exec...