News for hackers. Stuff that matters.

A comment on Ubisoft hacked, account data compromised. Parent comment

Re:Ubisoft hacked, account data compromised by thaumaturgy on Tuesday July 02, 2013 @06:25PM (#5981134)
The primary problem here would be a DoS attack against a web server that accepted that much data in a submission form.

edit: also, merely saying "bcrypt" isn't quite sufficient; we'd have to know what work factor you were testing with. bcrypt with a work factor of 2 is vastly different in performance from bcrypt with a work factor of 12.

[ Parent | on HN ]
Re:Ubisoft hacked, account data compromised by nknighthb on Tuesday July 02, 2013 @06:41PM (#5981202)
> we'd have to know what work factor you were testing with

Parentheses are not made to be ignored.

But I don't think it matters, which is why it was a parenthetical. The point is the relative differences between different sized strings, not the absolute timings.

[ Parent | on HN ]
Re:Ubisoft hacked, account data compromised by thaumaturgy on Tuesday July 02, 2013 @07:05PM (#5981316)
Whoops, sorry -- dunno how I missed that.
[ Parent | on HN ]
Re:Ubisoft hacked, account data compromised by Spittie on Tuesday July 02, 2013 @06:52PM (#5981261)
Isn't the password length check done locally on the machine (with javascript or similar)? If so, an attacker could easily ignore that check and send as much data as he want.

The check on that should (and, AFAIK, is) done server-side, with the server closing the connection after a certain amount of data or time.

[ Parent | on HN ]