lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Apr 2015 23:26:47 +0200
From: Per Thorsheim <>
Subject: Re: [PHC] Client-side hashing (was side-channel stuff)

Hash: SHA1

Den 24.04.2015 18:53, skrev Krisztián Pintér:
> Sascha Schmidt (at Friday, April 24, 2015, 6:34:04 PM):
>> 2015-04-24 18:12 GMT+02:00 Krisztián Pintér
>> <>:
>>> expiration yes, but it is not reckless. it is merely an
>>> inconvenience.
>>> and we are not talking about months here. we are talking about
>>> years.
>> I'm pretty sure that this is a common time span for at least some
>> scenarios.
> moore's law says 3% increase per month, 20% in half year. if our 
> security margin is so low we can't afford that, we are screwed
> anyway, and it is time to ditch password based identification.
>> I just personally have a great aversion of forgotten password
>> routines when it comes to usability and security. Maybe I just
>> haven't seen a good one yet.
> i agree that security is effectively nonexistent. but improving it
> is another story. launch the PRPC. as far as usability goes, i see
> no problem resetting a password after a year. i do it for some
> sites 3-4 times a year, minor annoyance. maybe i just got used to
> it.

Password policies are usually written by paranoid computer security
engineers, and they are almost never implemented as in writing, due to
constraints and sysadmins.

The same applies to most of the ecosystem around account registration
& password resets.

There are people out there researching & doing some really interesting
work into improving password resets now. The https link via
unencrypted email is easily accessible by many more than your favorite
.gov agency, and doing it over SMS instead doesn't really raise the
bar much for falling victim to a targeted attack.

All that, in combination with 2FA too often being a usability bolt-on
disguising as better security imho deserves a FSCK.

I have hopes for #passwords15 in Las Vegas (August) to perhaps shed
some additional light on these topics, and next iteration after that
will probably December 7-9 at the university in Cambridge, UK.

CFP submissions most welcome.

Best regards,
Per Thorsheim

Version: GnuPG v2


Powered by blists - more mailing lists