phc-discussions - Re: [PHC] Client-side hashing (was side-channel stuff)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 24 Apr 2015 23:26:47 +0200
From: Per Thorsheim <per@...rsheim.net>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] Client-side hashing (was side-channel stuff)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Den 24.04.2015 18:53, skrev Krisztián Pintér:
> 
> Sascha Schmidt (at Friday, April 24, 2015, 6:34:04 PM):
>> 2015-04-24 18:12 GMT+02:00 Krisztián Pintér
>> <pinterkr@...il.com>:
>>> expiration yes, but it is not reckless. it is merely an
>>> inconvenience.
> 
>>> and we are not talking about months here. we are talking about
>>> years.
>> I'm pretty sure that this is a common time span for at least some
>> scenarios.
> 
> moore's law says 3% increase per month, 20% in half year. if our 
> security margin is so low we can't afford that, we are screwed
> anyway, and it is time to ditch password based identification.
> 
>> I just personally have a great aversion of forgotten password
>> routines when it comes to usability and security. Maybe I just
>> haven't seen a good one yet.
> 
> i agree that security is effectively nonexistent. but improving it
> is another story. launch the PRPC. as far as usability goes, i see
> no problem resetting a password after a year. i do it for some
> sites 3-4 times a year, minor annoyance. maybe i just got used to
> it.

Password policies are usually written by paranoid computer security
engineers, and they are almost never implemented as in writing, due to
constraints and sysadmins.

The same applies to most of the ecosystem around account registration
& password resets.

There are people out there researching & doing some really interesting
work into improving password resets now. The https link via
unencrypted email is easily accessible by many more than your favorite
.gov agency, and doing it over SMS instead doesn't really raise the
bar much for falling victim to a targeted attack.

All that, in combination with 2FA too often being a usability bolt-on
disguising as better security imho deserves a FSCK.

I have hopes for #passwords15 in Las Vegas (August) to perhaps shed
some additional light on these topics, and next iteration after that
will probably December 7-9 at the university in Cambridge, UK.

CFP submissions most welcome.

Best regards,
Per Thorsheim

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJVOrUSAAoJEHJew+oCXWmfLMkH/A9Q6bPPp+YsxXph5ZlGPGPb
QQGHrOb/Wn0mQUNUmQ913IiJwo661OjXQ8fz9gixN35XILsB6ArLQv34eKX0gxhR
BLVECEhWCw9W71r2kPpwr5+3x013osBgml15PLQIGRnb/AL+Ns7RMPrU0YT+gsoF
rQXJrHpo2XOzjqMgfXR5hM4hOAfH3/RrLq+MdCM4stutc4pky2Q6yfeee9wEeZO2
JrTQET71iv0Yl1imGzEMmQx71NX1tRU7LaxKL498QDwb/IZOA6wR68SJhIiVvwwm
UkSDLa3qrMvfFwbB0BBgurp96iQEviDaP+1u1/6oNIFBl6tb33bYkOI4H1Lzeck=
=JsNj
-----END PGP SIGNATURE-----