News for hackers. Stuff that matters.

A comment on Auditor's response to "Our security auditor is an idiot" (Update 3). Parent comment

Re:Auditor's response to "Our security auditor is an idiot" ... by mckoss on Friday July 29, 2011 @11:50AM (#2822428)
I might suggest that the password pattern strings are encrypted using a key based on the user's password plus salt. This way, the password pattern list is only recoverable AFTER recovering the users password (via brute force). I think this solves the reduced search space problem of your scheme.
[ Parent | on HN ]
Re:Auditor's response to "Our security auditor is an idiot" ... by graham_holborn on Friday July 29, 2011 @07:46PM (#2824311)
$a = passwO_rd1; $b = ($a striped down to lower case); $c = ($b's metaphone); $d = md5(md5($a.'salt1'.b).$c.'salt2'); $e = md5(md5($c.'salt3').$c.'salt4'); Store $d as encrypted password then store $e as a string to check against. have $e saved in a separate communal database so to brute force $e and then guess the missing characters and the right user it would be. ([missing characters]^[character set])^([password lengh] ^ [users])^2 or something along those lines
[ Parent | on HN ]