LivingSocial Hacked – 50 Million Customers Affected

Re:LivingSocial Hacked – 50 Million Customers Affected by rajivm on Friday April 26, 2013 @05:35PM (#5615661)

Well if they don't have your source code, why modify the algorithm, you can just use sha1(password + user_salt + site_secret) -- that site_secret just made the sha1 unique to your site. Of course, if they have your source code, then it doesn't matter: they would have your 'site_secret' or your modified algorithm. Better would be not storing your site_secret in a accessible way (not on disk).

Edit: See udk1 below -- he's right, sha1 is an outdated algorithm for this purpose. Poor example choice on my part.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by ukd1 on Friday April 26, 2013 @05:46PM (#5615697)

You shouldn't use SHA: it's not designed for hashing passwords. Checkout bcrypt / scrypt and read: http://crackstation.net/hashing-security.htm

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by cschneid on Friday April 26, 2013 @06:08PM (#5615783)

That doesn't mean an additional secret stored on the server is a bad idea either way.

I've heard it referred to as a pepper (to go along with salt) and is in the application code.

bcrypt(password, salt, pepper) => hash. So even if they grab the db with the salt, the effective password to crack turns into 'password3jkl453jklgfuja9oph4mn" instead of just 'password'. Impossible.

And if they do get your site's code, you're back to a strong hashing algo and a salt.

[ Parent | on HN ]