101 reputation
bio website
location
age
visits member for 2 years, 4 months
seen Nov 7 '12 at 1:06

Jun
19
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
@curiousguy I disagree -- a variable declaration is source code, but the value used to initialize the variable is not necessary for a code review -- but perhaps you'd be happier with the term "resource".
Jun
18
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
@curiousguy: You can redact the key before sending the code for review, which is easy if you keep it in a separate file. Or you can leave the key out of source code altogether by putting it in shared memory or some OS-level repository. This sort of thing is commonly done by applications that deal with secrets, such as keys for assembly signing in .NET or shared secrets for interacting with third-party systems.
Jun
15
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
@curiousguy - Correct, but without access to the source code, you don't know the secret key that's hashed together with the profile data to generate the salt.
Jun
15
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
@curiousguy - Indeed. Generating salt from the user's profile gives extra protection against SQL injection, backup theft, or breaking into a database server... and as Ramhound points out, even if the application server is also broken into, you're still no worse off than with traditional per-user salt.
Jun
13
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
@curiousguy The threat I'm concerned with is any case where an attacker gains access to the database (as apparently happened at LinkedIn), without gaining access to the application source code or shared memory. SQL injection is just one of many ways that could happen. Good point about encrypting the rest of the database contents.
Jun
12
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
To clarify, I'm talking about a function along the lines of: salt = hash(combine(username, creation date, secret key)). The algorithm isn't secret, but the key is.
Jun
12
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
@curiousguy: You'd store the key in your source code or in shared memory. It wouldn't be safe from an attacker who has root access, but it would be safe from one who only has SQL access. That's not "security through obscurity" - all cryptography relies on being able to keep some value secret.
Jun
11
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
@curiousguy: You could calculate salt from the username, registration date, or some other unchanging profile field, using an algorithm/key that's unknown to the attacker (i.e. not stored in the database).