Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
8
Newest
 Scholar
Impact
~118 people reached

  • 0 posts edited
  • 1 helpful flag
  • 14 votes cast
Mar
3
revised How to store salt?
abbreviated
Oct
29
comment If I obtained a username and the salted password pairs from a server, can I login?
Channel binding should stop the MitM. MitM creates two channels: from client to attacker and from attacker to the server. Client and server then each see a different channel, therefore channel binding fails.
Oct
29
awarded  Scholar
Oct
29
accepted If I obtained a username and the salted password pairs from a server, can I login?
Oct
29
comment If I obtained a username and the salted password pairs from a server, can I login?
SCRAM's channel binding allows for TLS without CAs. Normally we need a certificate to ensure the server is who we think it is. Otherwise an attacker could pretend to be the server and intercept our password. With SCRAM, if the authentication process succeeds, the client can be sure that the server knew the password to start with and therefore the server is not an imposter. And if it was an imposter, the authentication fails and the password is not revealed.
Oct
29
awarded  Student
Oct
29
awarded  Custodian
Oct
29
awarded  Editor
Oct
29
reviewed Edit If I obtained a username and the salted password pairs from a server, can I login?
Oct
29
revised If I obtained a username and the salted password pairs from a server, can I login?
Typo, restructured the text, changed stole --> obtained
Oct
29
asked If I obtained a username and the salted password pairs from a server, can I login?
Jan
6
awarded  Citizen Patrol
Jan
6
comment Is badBIOS real?
The "primarily opinion-based" flag is a joke. One telling sign is that both the existing answers do agree with each other. The answer is "nobody knows" and that is as much of a fact as that the sun will rise tomorrow.
Dec
9
awarded  Commentator
Dec
9
comment What to do about websites that store plain text passwords
Storing a password in plain text is never better than storing it hashed, and you haven't given any examples to the contrary. You are right. It gives everybody more time to react should a leak happen. People tend to reuse passwords, so this is certainly valuable. I'll delete my "answer" lest I get even more downvotes.
Dec
9
comment What to do about websites that store plain text passwords
Sure I can. I can bruteforce it. Since the input was not not uniformly distributed ('password1' is more likely than 'asd865$*sdf.aa'), I stand a good chance of getting reasonable results reasonably quickly.
Dec
9
comment What to do about websites that store plain text passwords
I wouldn't compare hashing passwords to locking house doors. It is more like installing bars on windows, something "extra". And yes, you should not bother installing barred windows if you have just a cheap lock on your door and the door can be easily kicked open anyway. Web apps usually have ton of problems with web security: XSS, SQL injections and so on. One should focus on that and not waste too much time on what is essentially obfuscation. Chrome browser developers know that news.ycombinator.com/item?id=6166731
Dec
9
comment What to do about websites that store plain text passwords
I never said anything about keys when I spoke about hasking. All I said is And any hashing scheme will be broken eventually, given enough compute power. and I stand by it.
Dec
9
comment What to do about websites that store plain text passwords
Exactly. Encrypting or hashing the passwords leaves you with a false sense of security. With encryption, the attacker will probably get to your passwords and key at the same time. And any hashing scheme will be broken eventually, given enough compute power. With plaintext, you always know where you stand. There is no pretense of endpoint security. Endpoints will be insecure whatever you do. Look for example at the recent well publicized SSL bugs. Instead, focus on securing the communication, which is the only area where you stand a chance to make a meaningful increases in security.
Dec
9
comment What to do about websites that store plain text passwords
@ChrisMurray In addition to that, plaintext gives you the flexibility to use multiple auth methods for different things. Let's say that I want to authenticate visitors on my webpage with HTTP Digest. I need to have plaintext passwords for that.