News for hackers. Stuff that matters.
Re:Keeping Passwords Secure by ryan-c on Friday October 17, 2014 @11:45PM (#8474543)
They may just not want to disclose what they're using.
Re:Keeping Passwords Secure by limpon on Saturday October 18, 2014 @01:13AM (#8474674)
Are there any downsides to disclosing the hashing algorithm they're using? Does a hacker have an advantage by knowing this information.
Re:Keeping Passwords Secure by williamcotton on Saturday October 18, 2014 @05:43AM (#8475020)
I'm going to guess that they're referring to something like:

  HASHED_SALTED_PASSWORD = BCRYPT(PASSWORD, SALT)
  SALT_AND_PEPPERED_PASSWORD = HMAC-SHA256(SECRET_FACEBOOK_HASHING_KEY, HASHED_SALTED_PASSWORD)
BTW, this is not an example of "security through obscurity".
Re:Keeping Passwords Secure by consideranon on Saturday October 18, 2014 @01:08AM (#8474663)
If you base your security on obscurity, you're gonna have a bad time.
Re:Keeping Passwords Secure by cheepin on Saturday October 18, 2014 @04:53AM (#8474971)
Ever since my College Operating System's class, I've heard this line misunderstood time and time again. The real security principle here is "Principle of Least Privilege", not "Security through Obscurity". Facebook (I hope) isn't relying on some horrible security system to protect their users in the hope that no one guesses what it is. More likely, they are just hiding information that unprivileged users don't need to know. Maybe they rolled their own, maybe they are using someone else's technology, but they certainly have no obligation to their users to spell out exactly how they handle their logins.
Re:Keeping Passwords Secure by ryan-c on Saturday October 18, 2014 @10:13AM (#8475348)
Security works best when it is like an onion - layered.

Tweaking a password hashing algorithm (for example, changing the initialization constant in bcrypt) does not hurt security, and means that the attacker will not have sufficient information to crack the passwords with just a database dump, and even if they have everything a work factor should still deter cracking. Using md5 with the output xored against a constant would not, however, do much good.