Poll of the Day > "Passwords stored in a plain text database"

(+) Yeah! (+)

So I was looking up how modern conventions remember passwords. ASP.NET, probably the single most popular database framework, stores a PBKDF2 hash of the password. That's a hash of a password. PBKDF2 was handily cracked by GPU attacks and ASIC attacks.

Storing hashes of a password might as well be storing it as plaintext. Rainbow tables exist. We need to rely on TPM, isolated lockout mechanisms, and stop re-inventing the hash function. No matter how clever you make it, it's a simple matter of "what system resources does it take for you to realistically attempt to decrypt", and "how many resources are you willing to allocate". Your attacker is willing to allocate 30,000 times more than that.

just remember it

cool

oh man it's gonna be so epic when I have that put on my tombstone

salt and hash

Lokarin posted...

salt and hash

But hackers have rainbow tables for every salt! /s

Yellow posted...

ASP.NET, probably the single most popular database framework

https://www.statista.com/statistics/809750/worldwide-popularity-ranking-database-management-systems/

wut?

Krazy_Kirby posted...

just remember it

So just remember every single password for everything I sign up for ever? >_>

MrAntisocial posted...

But hackers have rainbow tables for every salt! /s

Ok, so then you can just run it on a GPU (PBKDF2 is cracked via GPU)

It doesn't take as long as you think to crack a password up to 12 characters in length via any hash, just because A) People want to use short passwords, and B) servers don't want to allocate too much resources into it

People think they can have their cake and eat it too. TPM/isolated lockout mechanisms or go home.

TC really wants us to think he's important enough to hack.

Veedrock- posted...

TC really wants us to think he's important enough to hack.

I've written WebGL shaders designed to crack partial keys, but ok, I really don't know how to boot up Kali Linux and run a script, can you show me?

That's true, I never learned how to hack because it only ever amounts to stealing things.

Fun fact: Hacking is basically just quality assurance done for "devious" means. There is nothing really fancy or "cool" about it.

Yellow posted...

Ok, so then you can just run it on a GPU (PBKDF2 is cracked via GPU)

It doesn't take as long as you think to crack a password up to 12 characters in length via any hash, just because A) People want to use short passwords, and B) servers don't want to allocate too much resources into hashing it

People think they can have their cake and eat it too. TPM/isolated lockout mechanisms or go home.

So it's entirely pointless to use argon2id and follow current owasp recommendations regarding passwords (not nist, which still recommends pbkdf2)?

Literally had a coworker implement passwords as plain text recently.
That guy should not be allowed anywhere near anything again.

Dikitain posted...

wut?

.NET people are extremely delusional. Almost as delusional as Java people.

Judgmenl posted...

.NET people are extremely delusional. Almost as delusional as Java people.

Look, I mixed up my stats, I'm not delusional, hahahahahahahah

I know it's up there. Anyway, I'm not as delusional as people who hate .NET, which runs at the same speed as C++ with JIT, and has been open source for 6 years.

MrAntisocial posted...

So it's entirely pointless to use argon2id and follow current owasp recommendations regarding passwords (not nist, which still recommends pbkdf2)?

I'm not claiming to have more authority over the standards, but also I think the standards are weak. If it's the industry standard what are you going to do about it?

I think KDF involving TPM modules is going to be the standard soon.

Judgmenl posted...

.NET people are extremely delusional. Almost as delusional as Java people.

Entity Framework is incredibly popular among .net developers. Not sure if it's the most popular, but it's probably up there.

Yellow posted...

I'm not claiming to have more authority over the standards, but also I think the standards are weak. If it's the industry standard what are you going to do about it?

I'll agree that the nist standards are weak. Owasp is a lot more up to date and is a lot more secure

Dikitain posted...

Fun fact: Hacking is basically just quality assurance done for "devious" means. There is nothing really fancy or "cool" about it.

Okay, so picture a guy in a hoodie wearing sunglasses and using two keyboards at the same time to hack into the mainframe.

That's like the pinnacle of cool.