News for hackers. Stuff that matters.
Re:Important Kickstarter Security Notice by danpalmer on Saturday February 15, 2014 @04:49PM (#7245506)
Can you update the blog post to remove the wording "encrypted". That is simply incorrect. There is a clear and incredibly important difference between hashing and encrypting, the latter being designed to be reversible.

I'd appreciate a description of the hashing algorithm being added to the blog post, but that's less important.

If you say "encrypted", I read that as "somewhere we have a key that gives the attacker plaintext passwords, they might have that key as well".

Re:Important Kickstarter Security Notice by tptacek on Saturday February 15, 2014 @05:11PM (#7245623)
This wouldn't be pedantic if we were discussing communications between cryptographers and other technologists, but this is a public notice, and so the point is very pedantic. For all intents and purposes, the password hash or authenticator of a password is its "encryption", in the layperson's sense.
Re:Important Kickstarter Security Notice by larrys on Saturday February 15, 2014 @06:14PM (#7245894)
Exactly.

In business the "simplicity abstraction layer" [1] on a product is essentially taking something that was created by hackers for hackers (or engineers) and making it simple for end users "the layperson".

God knows anytime you can make something easy for a layperson and not make them think there is money to be made. They aren't interested in your Liebert fire protection system and diverse path routing.

It never fails to amaze me how highly technical types simply can't think out of that box. And yet they make fun of "sales types" that can actually speak and sell to end users an inferior product.

[1] I actually just made that up.

Re:Important Kickstarter Security Notice by jimktrains2 on Saturday February 15, 2014 @06:36PM (#7245984)
But still, you could write "Our passwords are stored securely using the bcrypt algorithm; however, weak passwords..." and not compromise terms.
Re:Important Kickstarter Security Notice by hawkharris on Saturday February 15, 2014 @04:53PM (#7245524)
Hashing is often referred to as one-way encryption.

For example: http://publib.boulder.ibm.com/infocenter/zvm/v5r4/index.jsp?...

Re:Important Kickstarter Security Notice by bbosh on Saturday February 15, 2014 @05:09PM (#7245613)
When communicating with the general public, it's useful to use words they understand.
Re:Important Kickstarter Security Notice by Everlag on Saturday February 15, 2014 @05:16PM (#7245651)
The difficulty of linking to a high level definition of a hash function and its differences to encryption is not very high.

If a customer were to be curious as to what hashing is then that link should clear it up perfectly.

Re:Important Kickstarter Security Notice by rybosome on Sunday February 16, 2014 @04:11PM (#7249331)
Do you thoroughly research the scientific, business, legal, medical, philosophical, religious, etc. underpinnings of every article you read? Just because you're knowledgable in this area doesn't mean everybody should be. Using the term "encrypted" rather than "hashed" is perfectly appropriate for a general press release. This is a highly pedantic criticism.
Re:Important Kickstarter Security Notice by ufmace on Sunday February 16, 2014 @10:41AM (#7247909)
Missing the point. Most of the customers do not know or care what the difference is, will never read any definition or explanation of it, and shouldn't have to. If you try to force your customers to understand this stuff, they'll get confused and annoyed, and go with someone else who can make it clear for them.