To Keep Passwords Safe from Hackers, Just Break Them into Bits

Re:To Keep Passwords Safe from Hackers, Just Break Them into... by ZoFreX on Tuesday October 09, 2012 @11:30AM (#4632063)

The number one problem with passwords is that most websites are not storing them using current state-of-the-art methods that are freely available. Whether or not this is an improvement, it doesn't solve the actual problem - developers aren't going to suddenly start using this if their current method is md5(password).

That said, it does sound quite interesting from a crypto geek perspective.

[ Parent | on HN ]

Re:To Keep Passwords Safe from Hackers, Just Break Them into... by 7952 on Tuesday October 09, 2012 @11:48AM (#4632196)

We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites. That is how the web actually is already, and it is unlikely to change any time soon.

[ Parent | on HN ]

Re:To Keep Passwords Safe from Hackers, Just Break Them into... by nathan_long on Tuesday October 09, 2012 @12:28PM (#4632432)

>> We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites.

I don't follow you. In the first sentence, the "we" is developers of web sites, right?

Who is the "we" in the second half? Who are you suggesting should assume developers will make mistakes, and what can/should be done to mitigate that?

One possible interpretation is that the second "we" is users, and as a user, yes, I do assume that sites will make mistakes. One reaction is not re-using passwords. But if the user and the site are both naive, I don't see who is left to keep the wolves out.

[ Parent | on HN ]

Re:To Keep Passwords Safe from Hackers, Just Break Them into... by 7952 on Tuesday October 09, 2012 @03:20PM (#4633475)

Sorry my comment was inarticulate. I am arguing for a collective sense of mistrust regardless of who you are.

[ Parent | on HN ]

Re:To Keep Passwords Safe from Hackers, Just Break Them into... by 0003 on Tuesday October 09, 2012 @12:07PM (#4632312)

Has there been paper, or for that matter a blog-post with a napkin calculation, on the cost-benefit of a proper password/authorization system versus a non-robust system discounted for reputation loss / legal liability for system compromises? I did a few google queries but came up empty. I think this would make for a great PSA.

[ Parent | on HN ]