The DMZ

« first day (4066 days earlier) ← previous day next day → last day (1112 days later) »

MechMK1

10:16

> "Alright, we're in."
> "Really? That quickly? What did you do to escalate your privileges? Some kind of 0-day?"
> "You know how on Windows, you have to confirm if you want an application to be able to do administrative stuff?"
> "Yeah, I do. Most people just..."
> "Exactly, most people just click yes without giving it a second thought."

Q: Would this be considered a secure password hash?

I think I've understood properly, but I want to make sure as this will involve money. Password requirement is a minimum of 16 characters and must contain one of each [Upper, Lower, Digit, Other] My salt is Crypto RNG generated 64 bytes I convert salt to Base64 (without the trailing ==) I then ge...

I hate this question, because I encounter it all the time

Customer uses SHA-1. I tell them it's insecure and that they should use Argon2 because it's memory hard. "But it's a server" Yeah no shit it's a server, where do you think people usually hash their passwords? On their fucking smart dildos?

schroeder

10:32

I have been fighting with Bumble for weeks now since they keep sending me daily email confirmation links even though I have not signed up. Someone else used my address by mistake. Bumble keeps telling me that my address is not in their system for any valid or invalid accounts. What's weird is that the confirmation link has 3D prepended to every URL parameter. Like UID=3D1720210685= and m=3D600 and mail_token=3DQGVuYzo... is this a known pattern?

It's relevant because I'm trying to help them sort out their issue and the username in the link is login=3Dmox%3A%3A%3Ajacob.schroeder.22

so is the account jacob.schroeder.22 or mox::jacob.schroeder.22 or what?

schroeder

10:47

ahhh, that would be %3D or =. They have a bug.

schroeder

11:01

yeah, it's in every email they send, even the support emails, and is in all the HTML in each email.

schroeder

11:25

@MechMK1 The community really needs to decide if they want to review and evaluate every rando's algorithm. If it was me, I would create a requirement that every such question about a practical application of password hashing in a live environment must include how it is superior to Argon2 and why they need to roll their own. It seems to me that once people learn there is a standard approach, they might simply back off.

MechMK1

That would be good, especially since such questions are very unlikely to benefit third parties

The lesson "Don't roll your own" has been conveyed though other questions already

schroeder

But that gets debated - how can people learn if they don't roll their own? My suggestion is that the asker prove they understand existing algos and can compare them to their bespoke approach. Especially when they want to apply to live environments.

Journeyman Geek

@schroeder Depending on volume, the other option is to have a space for that - a crypto equivilent of code review?

MechMK1

@schroeder Fair point. I guess it's up to the crypto community to decide that

God, I am so happy that when I say "crypto", everyone here understands I mean cryptography and not cryptocurrencies

Journeyman Geek

@MechMK1 ... this is ~~sparta~~ security.se after all

MechMK1

11:37

I prefer the term Sec.SE for obvious reasons :D

schroeder

Yeah, it's totally up to them. I have no skin in the game. But as a solution to what appears to be a common problem, setting a gate would appear to provide access to the community while improving question quality.

MechMK1

I personally agree that that'd be a way better system. I hope no one is going to complain about "gatekeeping" though.

Journeyman Geek

benevolent gatekeeping is essential

schroeder

There is always a polarity tension between openness and closeness. You can't accept everything.

You shouldn't accept everything and you shouldn't reject everything. There needs to be a path.

MechMK1

11:53

I've long been a proponent of gatekeeping as a means of keeping a community healthy, so I may be rather biased in this regard.

Though I am afraid that many people will answer how their algorithm is better than argon2 somewhere along the lines of "I couldn't find an argon2 implementation for my environment"

Which, by the way, is still the reason why I can't use argon2 in .net core

I found one (1) implementation, which uses libsodium, but it caps the parallelism to 1, meaning that I will always gain sub-par performance

« first day (4066 days earlier) ← previous day next day → last day (1112 days later) »

all rooms