ctftime.org/event/809

@BenoitEsnard @HamZa @Xavier59 @Arminius @Gilles

Why are people so hung-up on brute forcing? It's the third time this month that someone tried to explain to me that "real security does not exist because you can always brute force the credentials".

And when I try to explain that brute forcing a password with 256 bits of entropy would literally take forever, they just fall back to "So there is a chance, and therefore it's not secure"

People with a rudimentary grasp on security are so, so much worse than people who at least know that they have no clue.

@MechMK1 lol

@HamZa I once had a guy explain to me that adding salts to passwords, then encrypting them with AES and using the hash of the password as password for AES is "industry standard". So his model looked like: aes(hash(password), password+salt). Upon login, the user input would be hashed, the hash would be used to decrypt the password, and then the input plus salt would be compared to whatever was decrypted.

Absolutely surreal

haha wow

It was wild. My best guess as to how it happened, was that someone was tasked with "Make the login secure!", then read about things like salts, hashes, someone writing "encrypt passwords with a hash" and possibly smoked some weed too.