Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by Pyroshock on Tuesday September 25, 2012 @03:50PM (#4572300)

There's a reason key derivation functions like PBKDF2 and bcrypt still require a salt as an input.

[ Parent | on HN ]

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by pjscott on Tuesday September 25, 2012 @06:07PM (#4572949)

And there's a reason why high-level libraries like bcrypt handle salt generation and storage internally: if they didn't, people would screw it up. It's amazing how many people blithely use some crazy scheme like

    pwhash = md5("this is my salt" + password)

Progress in password hashing security is primarily progress in making things trivially foolproof and then hectoring people into using them.

[ Parent | on HN ]

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by rdzgtdsv on Tuesday September 25, 2012 @10:52PM (#4573976)

Doesn't this crazy scheme protect against brute force when only database is leaked, and "this is my salt" remains secret?

[ Parent | on HN ]