Suggestion: Salt md5 passwords with $dbpass

[The Beatles]

N/T

[Veranor]

If someone compromises the DB and tries to crack the passwords... then they already have the dbpass (well, probably), so it's not as effective is it? Unless the idea is to prevent pre-generated md5s from being used.

[The Beatles]

Yes, that was silly, wasn't it? I probably meant with their username.

[Urran Voh]

Does anyone else (besides Devari) have any clue as to what these two are talking about?

[Veranor]

Yes, that was silly, wasn't it? I probably meant with their username.

If they have the db compromised and access to the md5 hash, then surely they have access to the username?

Or did you mean a salt derived from the username (some weird way of splitting it up or what not)?

This the issue I see with salts in our case:

1) The algorithm for generating them is public
2) The hash, if compromised, pretty much means every other bit of data stored with it is most likely compromised

...unless the salt method/data is stored in a config file and is generated by some config program. In which case we're fine as long as they don't compromise both source and db.

We probably should renovate the pass storage and stuff... maybe switch to SHA-1 while we're at it.

EDIT: http://en.wikipedia.org/wiki/Salt_%28cryptography%29

I guess they claim that the usage is primarily to prevent the use of pre-generated dictionary attacks - forcing the attacker to generate all of the hashes. Hmmm, I had always thought it was also just to make it hard to break as well but maybe not I guess. In that case then, we don't really need to make it private. Using username would be good because it would prevent checking against the whole db.

[The Beatles]

In addition, two users who choose the same pass wouldn't get the same hash.

[Slasher]

Does anyone else (besides Devari) have any clue as to what these two are talking about?

They are on about md5 passwords in the SQL database (I think) and ways of making them more secure (I think). md5 can now be cracked (So I heared/read) so they are looking for more secure ways of storing passwords (I think).

Not sure but its something to do with md5

[bjornredtail]

MD5 sums can only be found by brute force, or dictionary attacks. The MD5 dictionary attack often depends on pre-summed values to avoid having to take the MD5 of every word in the dictionary, thereby saving some processing time. By adding a salt (some odd additional characters), this defeats the pre-calculated tables, requiring an attacker with password hashes to calculate the hash for any given password, as opposed to just using a pre-calculated table.

[Cfelicio]

better store as plain text, so the person who is going to hack will be happier and problably will not cause much harm...

[Veranor]

better store as plain text, so the person who is going to hack will be happier and problably will not cause much harm...

Heh. The taoist/defeatist IT strategy.


I think Slasher is referring to reports of collisions in md5.

[Tetigustas shadowson]

personally I would like to see a package the attackers reach first off a small db that’s not really a db instead its alive ....*laughs*
it records your computers settings and saves the user data alright and when they open the fake db payload it changes the attackers computer settings to mirror yours...
in essence an STD for computers only you want this one because its contagious to hackers...

Could you imagine their drive suddenly changing from a 50 gig to a 4.3 gig.…*laughs*
Or their CPU settings go nuts because it’s a super colossal CPU not a Pentium 2…haha

Don’t get me started I could happily smash some fingers for what s been done to our server in the past.

[Slasher]

better store as plain text, so the person who is going to hack will be happier and problably will not cause much harm...

Heh. The taoist/defeatist IT strategy.


I think Slasher is referring to reports of collisions in md5.

I dunno what I was referring to *laughs*... I know the passwords are stored or were stored as md5 which was suposedly uncrackable... However it's possible to crack it now (I think)...

[The Beatles]

Tetigustas, I think what you're referring to is "magic", and we don't have that in the IT world...