2,694 reputation
51526
bio website codinghorror.com/blog
location El Cerrito, CA
age 43
visits member for 3 years, 5 months
seen Jan 25 at 0:18

Stack Overflow Valued Associate #00001

Wondering how our software development process works? Take a look!

Find me on twitter, or read my blog. Don't say I didn't warn you because I totally did.

However, I no longer work at Stack Exchange, Inc. I'll miss you all. Well, some of you, anyway. :)


Feb
28
awarded  Nice Answer
Nov
11
awarded  Yearling
Sep
25
awarded  Popular Question
Aug
13
awarded  Great Question
Mar
20
comment XKCD #936: Short complex password, or long dictionary passphrase?
@gilles well, I do agree that length is an issue in a realm of hardware cracking, see my blog post codinghorror.com/blog/2012/04/speed-hashing.html -- I used my own video hardware, two high end ATI 7970s.. but people ARE implying that pass phrases can be cracked more easily as a pattern just like l33tsp34k can.
Mar
20
comment XKCD #936: Short complex password, or long dictionary passphrase?
@gilles as I said "In other words, will they actually attempt common schemes like "dictionary words separated by spaces", or "a complete sentence with punctuation", or "leet-speak numb3r substitution" as implied by xkcd?" So I will concede very basic leet-speek tables -- as Meat Loaf once said, Two out of Three Ain't Bad. But I won't concede anything else, unless you prove otherwise by cracking the above password for me! I eagerly await your results!
Mar
20
comment XKCD #936: Short complex password, or long dictionary passphrase?
@gilles well I wasn't really referring to that one, as basic letter-to-number sev7n style substitution is, admittedly, pretty mechanical if you do it totally consistently and repeatably. But passphrases are a different story. If I told you my password is "I live at 55 Maple Lane in Boston", show me the tool that will crack that in sane time using rules and not brute force. I'd love to see it, if you can. :)
Mar
15
comment XKCD #936: Short complex password, or long dictionary passphrase?
@Gilles " If there isn't any low-hanging password fruit (and oh, there always is), they'll just move on to the next potential victim service"
Jan
27
comment Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
hovering will not work on tablets / touch devices, which will be an increasing percentage of the computing devices in the world every year from now on.
Dec
4
revised How do certification authorities store their private root keys?
deleted 11 characters in body
Dec
3
awarded  Booster
Dec
3
awarded  Announcer
Nov
24
reviewed Approve suggested edit on How valuable is secrecy of an algorithm?
Nov
16
awarded  Nice Question
Nov
15
asked What are the supposed security benefits of a “dead-drop” email strategy?
Nov
11
awarded  Yearling
Sep
21
awarded  Custodian
Jul
30
awarded  Publicist
Jul
30
comment How can crackers reconstruct 200k salted password hashes so fast?
even with a tiny 4 character salt, assuming formspring has a reasonable minimum password length (let's say 7 characters) that puts the brute forcing at a minimum of 11 characters which is deeply into "not possible with any known computing technology" territory. I think we have to conclude that the original crackers must have the salts (as Remus pointed out in the comments to my answer, this is extremely likely), and for some reason just chose not to publish them.
Jul
30
comment How can crackers reconstruct 200k salted password hashes so fast?
it doesn't matter if the term salt means public, the salt was not published with the hashes. Compare the LinkedIn breach, where unsalted password hashes were posted. I agree that it is strange, because the crackers very likely know the salts. But not sharing them and posting just the password hashes alone means nobody can crack any of those posted password hashes; based on the math, no known computing technology is fast enough. So you have to ask "what is the purpose of publishing just the hashes of salted passwords?" Is it merely to show off and prove you did it?