News for hackers. Stuff that matters.
Re:Weblog.sh – hosted blogging from the command-line by zx2c4 on Tuesday November 24, 2015 @05:21AM (#10620032)
Another service using pathetic password hashing:

https://github.com/hmngwy/weblog.sh/blob/master/lib/ssh/exec...

      else if(command[0] === 'password') {

        if(args.length===0) {
          stream.write('→ You need to specify a password.\n\r');
          stream.end();
          return;
        }

        var hash = require('sha256');
        var payload = args;
        var salt = schemas.randomString(32);

        userMeta.user.hash = hash(payload + salt);
        userMeta.user.salt = salt;
        userMeta.user.token = schemas.randomString(64);

        stream.write('… Saving new password'+LB);
        userMeta.user.save(function(err, saved){
          if(err){
            stream.write('→ Password update failed.'+LB);
          }

          var response = [];
          response.push("→ password for "+saved.username+" updated"+LB);

          stream.write(response.join(LB));
          stream.exit(0);
          stream.end();

        });

      }
Re:Weblog.sh – hosted blogging from the command-line by vruiz on Tuesday November 24, 2015 @07:16AM (#10620298)
"pathetic" is a bit harsh. Yes, one should be using b/scrypt nowadays but at least he's using salt and sha256 it's not md5. It could be better, but it could also be much worse.
Re:Weblog.sh – hosted blogging from the command-line by iancarroll on Tuesday November 24, 2015 @08:12AM (#10620458)
sha256 is not "better" than MD5 for password hashing; they're both incredibly fast to brute force and both not meant for password hashing. bcrypt/scrypt, configured correctly, are much slower and much more secure.
Re:Weblog.sh – hosted blogging from the command-line by feld on Tuesday November 24, 2015 @09:42AM (#10620952)
salt adds a minor hurdle and that's it.
Re:Weblog.sh – hosted blogging from the command-line by TazeTSchnitzel on Tuesday November 24, 2015 @08:21AM (#10620493)
PHP has an easy-to-use password hashing function with secure defaults right there in the standard library:

http://php.net/password_hash

This is one idea of PHP's that other languages should copy.

Re:Weblog.sh – hosted blogging from the command-line by z3t4 on Tuesday November 24, 2015 @09:00AM (#10620685)
Hashes are generally used to check data integrity ...

When hashing passwords you want a function that is slow and have MANY (but not too many) collisions so that it can not be brute-forced in any direction.

Re:Weblog.sh – hosted blogging from the command-line by thiht on Tuesday November 24, 2015 @10:42AM (#10621325)
>have MANY (but not too many) collisions so that it can not be brute-forced in any direction

I don't understand this part? Basically if I'm able to find a collision it's like I found the real password, so why is a function with many collisions better for password hashing? Is there a way to differentiate the collisions?

EDIT: typo

Re:Weblog.sh – hosted blogging from the command-line by iancarroll on Tuesday November 24, 2015 @12:11PM (#10622022)
You don't want collisions, as the entire point of a hashing algorithm is to _not_ have collisions. I'm not sure what the OP is talking about.

What you really want for password hashing is a key derivation function, which will generate a random, unique hash slowly.

Re:Weblog.sh – hosted blogging from the command-line by z3t4 on Tuesday November 24, 2015 @05:46PM (#10624123)
Lets say someone gains access to the password hashes, he/she can compute hashes until a match is found. And then login to that particular system, but does not know the secret (if there are many collisions, and the pw is random). I'm no expert though, and I assume that if someone gains access to all the password hashes, he/she already has access to the system.
Re:Weblog.sh – hosted blogging from the command-line by darshanrampatel on Tuesday November 24, 2015 @05:38AM (#10620073)
Can you explain why this is no good? Just sha256?
Re:Weblog.sh – hosted blogging from the command-line by iancarroll on Tuesday November 24, 2015 @12:13PM (#10622035)
SHA256 is a hashing algorithm, which is supposed to be able to create a checksum fast. However, you don't want your passwords to be cracked at a fast speed, so you use a KDF like bcrypt or scrypt, which is much slower and harder to implement on GPUs.