« first day (811 days earlier)      last day (4141 days later) » 

6:00 PM
Hey Maxell, recall our earlier discussion about hashing?
 
resis
 
hm...
random flash crash is random
 
lol nm. It is a really old book.
 
cubiq.org/add-to-home-screen is there any alternatives for this?
 
6:05 PM
@Sommer yes
 
I had given it some more thought and while I really dig how you're generating random salts for each user, I think there's an architectural flaw in how you then store it.
 
You couple the generated salt with the user in the user table, correct?
 
lol
 
Evening people
 
@PeeHaa Y U NO OUT DRINKIN?
 
What's the number one attack salting hashes is done for? An SQL breach, e.g. injection, root access, whatever - where the user table is dumped and unsalted hashes could be reversed to the original password using a rainbow diagram for example.
 
@webarto Just got home from work
 
So if I sign up with your website, and someone dumps the user table, they can't then take my password and get into my VISA/IRS accounts
 
@Sommer Do you know what a salt does?
 
6:10 PM
Of course.
 
@PeeHaa I never experienced that :P
 
You sure?
 
However, if you're generating these salts and storing them in the user table itself, you might as well store the passwords in a plaintext format.
3
 
lol
 
Cause for some reason I kinda doubt it (no offense)
 
6:10 PM
it gets even funnier :D
 
Enlighten me
 
I can haz IRS
 
@PeeHaa Yeah, I get that feeling too ^^
 
@Sommer Just search on the webs what a salt does
 
@Sommer no....
 
6:12 PM
@Peehaa, I already do.
 
@Sommer With the proof of work in bcrypt, all but the most trivial passwords are practically impossible to reverse
 
@Sommer Then tell us in a few words what a salt is supposed to do (in your understanding)
 
Good, Keep going at it :)
 
No offense, but I've been dealing with this for years. If you make a blanket statement implying I have no knowledge on the subject, I'm gonna need more than a plain "Go to google"
 
You seem to think of it as some kind of cryptographic secret
 
6:13 PM
@PeeHaa o deer lawd, look what we have here
 
@NikiC, that's my impression.
 
by definition, it's not a secret
 
Now, care to correct me?
 
That impression is wrong
 
just like an Initialization vector. Neither are secrets...
 
6:14 PM
The salt only exists to make it impossible to amortize hash cracking across several users with the same password
 
There's a substantial difference with an initialization vector.
 
The salt makes sure that you have to brute force every hash individually
 
The IV is actually worked into the initial bytes of a cryptographic result
 
it is?
 
It's nothing more than an offset for the algo.
 
6:15 PM
. . .
 
HUH?
 
Yes. In Rijndael you'll find the IV in the initial 16 bytes of the encrypted data.
 
No
Rijndael does not even take or USE an IV
IV's are used by Modes. which run on a primitive algorithm
and in general, the IV can be the first 16 bytes, the last, somewhere in the middle, or not provided
depends on the derivation methods used...
 
I've got the Rijndael specifications for both rounds of the AES submission lying 2 feet away from me.
I don't read fiction.
 
@Sommer Then you don't know how to read
 
6:16 PM
Alright.
 
No cryptographic primitive block cipher takes an IV...
 
Let's change tactics. Let's forget terminology and the whole subject of cryptography save for the hashing itself.
And let's go with "secrets"
 
Chaining modes are what use the IV
Nio
no, because a salt is by very definition not a secret
 
Forget I ever mentioned salt. Let's go with secret.
 
and you trying to make it one for your purposes isn't how it works.
 
6:18 PM
@Sommer toomanysecrets?
 
You generate the secret for each user and then store it in the user table, correct?
 
@Sommer No
 
Hm. I must be misremembering then.
Where do you store them, out of curiosity?
 
@Sommer You generate the non-secret salt for each user and then store it in the user table
 
because no secret is generated
 
6:19 PM
..
 
Was it not you who insisted on generating a separate secret for every hash?
 
@Sommer Salts are not secrets.
 
> Salt A non-secret binary value that is used as an input to the key derivation function PBKDF specified in this Recommendation to allow the generation of a large set of keys for a given password
 
Okay, we're back to calling them salts then.
 
6:19 PM
@Sommer We insist on generating a separate salt for every hash, but we don't say this salt is a cryptographic secret
 
You know what, forget it.
Okay, great, making progress.
 
@Sommer No, we're back to calling them what they are
 
Ircmaxell, I called them that minutes ago. This was wrong.
But I'm moving past it. And dare I ask, where do you store your salts?
 
@Sommer You're playing word games. Cryptography doesn't work like that
 
No calling it secret is wrong
 
6:20 PM
This is the meat of my argument.
 
Right next to the hashed password.
 
@Sommer right with the hash
 
@Sommer Then you must be a vegetarian.
 
And there we go.
 
A salt is not a secret
 
6:21 PM
I think I go write a user script to answer @Sommer ;)
 
@Sommer So do enlighten us, where is the issue with storing the salt next to the hash?
 
So if I were to dump your user table, I would have the salts I need to generate an identical hash in a rainbow table?
 
6 mins ago, by NikiC
The salt only exists to make it impossible to amortize hash cracking across several users with the same password
 
hey guys
 
if you want a secret, generate a cipher key, store it somewhere else, and encrypt the resulting hash+salt and store the encrypted text in the db
 
6:21 PM
@BenJones Jo
 
@BenJones good morning/afternoon/evning
 
@Sommer We are dumb in here, could you break up the cracking process in a few more steps for us? Because I'm not sure what you want to do
 
@Sommer Yes. but that's computationally impractical for all but the weakest of passwords...
 
@Ircmaxell, but still, wouldn't it be wiser to store them on, say, the filesystem?
 
which is the entire point of bcrypt. Because storing secrets is hard
@Sommer far easier said than done
 
6:22 PM
So to make this threat theoretically possible, both the SQL server and file system must be breached?
 
I need to click on a row from a table and pass that data into a web form
having some issues
anyone able to help?
 
@ircmaxell, how so?
 
@Sommer , could you please follow the instructions ? Instead of pulling "what-ifs" out of your a**
 
I think this is relatively simple stuff if you know what you're doing.
 
@Sommer You're here arguing the differences between salt and secret, and you don't know that building a reliable and secure key store is very non-trivial?
 
6:23 PM
I'm not arguing the differences between anything. I'm asking you if it's wise to store the salt next to a hash without making the salt completely redundant once it's actually needed to complicate someone reversing the hash to its original input
You argued terminology and detracted from that subject.
 
The salt exists for one reason...and @webarto just quoted it.
 
OK so here is the PHP code...
$(document).on('click', 'tr', function() {

        //Get the ID from the row clicked
        var id = $(this).data('recordId');

        //short-hand
        $('#section2').load('data_entry_form.php?id='+id);

});
 
I know. That's precisely what I just said.
 
@Sommer Go home, you're drunk.
 
sorry that is the javascript
 
6:24 PM
@BenJones Wow, that's some cool PHP code
2
 
:P
 
lol
 
jPHP
 
making the salt completely redundant? HUH?
 
@webarto jQueryPHP
 
6:25 PM
here is the PHP
 
pQuery
 
<?php $id = (int)$_REQUEST['id']; ?>
<?php  echo $row['id']; ?><br>
 
Okay Maxell, let's break it down.
 
No
 
@BenJones thats some horrible jquery code .. again
 
6:25 PM
You get an input password. You mixed this with the salt, and hash it.
you then put the output and the hash in the same table.
 
yikes...
 
how comes people never paste good code that uses jquery ?
 
This is as hopeless as teaching a llama to drive.
 
Meh.
 
hahah
 
6:26 PM
Forget it.
 
@Lusitanian Maybe even less hopeless? :D
 
@tereško because it's jquery...?
 
OK well what is wrong with this jquery code now?
 
@Sommer write it up and send it to openwall.com/lists/crypt-dev
 
@Sommer , please listen to experts and stop making sh*t up
 
6:26 PM
The Dunning–Kruger effect is a cognitive bias in which unskilled individuals suffer from illusory superiority, mistakenly rating their ability much higher than average. This bias is attributed to a metacognitive inability of the unskilled to recognize their mistakes. Actual competence may weaken self-confidence, as competent individuals may falsely assume that others have an equivalent understanding. David Dunning and Justin Kruger conclude, "the miscalibration of the incompetent stems from an error about the self, whereas the miscalibration of the highly competent stems from an error ab...
 
@ircmaxell, this has nothing to do with that.
 
@Sommer How so?
 
anyone up for testing my site ?
 
@Sommer You really shouldn't forget about this. You said above that you've been doing this for a long time, which makes me somewhat afraid. Please make sure that you properly investigate your issue and find out why you are wrong.
 
6:27 PM
I was merely asking whether everything was stored in the right place. You conceded that the filesystem would be more optimal, but was difficult
 
... and there is one more user in the small-avatar-list
 
But we've bobbed around that subject quite extensively as a lot of people washed ad hominems over me but whenever anything actually relevant was posted it fell in line with what I'd originally said.
But like I said, forget about it. I don't need the competition ;)
 
@hakre do you think the PHP is ok?
 
@Sommer The main point is that bcrypt is secure even if the salt is not kept secret
If you keep it secret, fine, won't make it worse
It's just not necessary
@Sommer And even if you might not believe us, you may have missed the quote @ircmaxell posted above: "A non-secret binary value that is used as an input to the key derivation function PBKDF specified in this Recommendation to allow the generation of a large set of keys for a given password. " (Emphasis mine)
This is from the NIST-approved PBKDF2 spec
You can't really get more authoritative than that
 
Gathering knowledge from Google, please wait...
 
6:35 PM
night ,,
bye..
 
@NikiC , you are naive
 
@tereško I have a right to be naive
I believe in the good in people
 
Sommer has already come to a conclusion .. all he had been doing here is trying to convince himself that everyone agrees with him
nothing that you say can penetrate
 
@NikiC That's not really the best attitude when it comes to security ;)
 
.. or life in general
 
6:38 PM
:)
 
Back, with burgers.
 
@Sommer What is that burgers? Some kind of secret? ;)
 
@PeeHaa clever
 
PeeHaa, not anymore. I cracked the BigMac recipe :P
Do you have linkage to that spec, NikiC?
 
@Sommer Screw safe storage of passwords! BigMac!!!
Although I do prefer the burger king :(
 
6:46 PM
Do you have the Coca-Cola recipe too?
@PeeHaa I like Five Guys, but it's only in the USA.
 
No photoshopped burgers on the site :(
 
@NikiC, I've only grazed upon Bcrypt. I'm definitely interested in more info. Where does it get its "unique" offset for the key, though?
I'm assuming it blends this hash with a secret, or uses it as an index for a key container?
 
:)
 
@PeeHaa, I'm with you on the burger king, though I really like the BigMac's sauce. I've managed to very closely emulate it, but they're using some spin on thousand island dressing..
I should try a hint of galangar
 
Probably you are trying harder than they do to make the sauce
 
6:52 PM
-7
Q: So long hats, and thanks for all the fish!

amanaP lanaC A nalP A naM AWhen I get back to Stack Overflow next week the hats will be gone, and we will be back to our normal scheduled routines. Just wanted to have this opportunity to say -- so long. Anybody want to make some hat related haikus?

HATS!
LOL @PeeHaa
 
@PeeHaa haha love how I got downvotes to start. hopefully ill get upvotes soon :-)
 
:P
 
"Flagged as "Not a real Haiku"" xD
 
@Alexander LOL
 
7:00 PM
Your hat looked good Neal
 
@Sharlike ^_^
 
just photoshop it in there afterwards haha
 
@Neal, your Haiku even got downvoted. That's just sad
lol
 
@Alexander lol yea. I removed it. Noone loves me :-(
 
7:02 PM
Thanks
 
Loving the meta downvotes LOL
 
Someone is gonna call it
 
Anonymous
Is there any logical or technical reason why array starts indexing values from 0?
 
Anonymous
thanks
 
7:08 PM
@Sommer The main part of bcrypt is the eksblowfish algorithm. Just look it up, it's not particularly complicated. It expands the key 2^cost times (always first with the key, then with the salt)
 
@PeeHaa I am not sure why it got closed lol
 
> As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.
 
@PeeHaa haha. its not not constructive for meta. hopefully it gets reopened :-D
 
@BenJones normally it is.
 
just made the mistake of reading christianity.stackexchange
 
7:17 PM
Thats why i go onto mi.yodeya.com ^_^
in JavaScript, 6 secs ago, by Neal
anyways. Shabbat is in 2 hrs. later ppl!
 
enjoy
 
@PeeHaa, that's actually nice. Polite enough even if it was an appropriate closing
 
@Alexander I never get bad mails from people of SO actually.
 
@PeeHaa you shouldnt make emails public
the sender may not like that
 
@PeeHaa didn't sign NDA
 
7:29 PM
@PeeHaa, I see
 
@Olli I doubt OP would sue me over copyright
 
It's a matter of privacy, not copyright
 
yes I meant that
no copyrighht,but a privacy issue
 
This user's full name is now known to this chatroom.
 
there is also his email addres visible
that email address may be private
 
7:32 PM
tsk tsk
 
God that bugs me when I see it on a large scale.
I know some retailers who run FB pages with a fairly high volume of visitors, and hold auctions or otherwise specials based on their sales.
 
@Sommer Oh noes. The users name is known in this chatroom...
 
When someone purchases something in those events, they publish the full name and link to the FB page of the buyer.
 
Hi guys, do you know about a good PHP code sandboxing project? I was searching and so far I've found github.com/fregster/PHPSandbox
 
I grit my teeth everytime I see an update like that flash by
 
7:36 PM
@PeeHaa, lol
 
I was unaware of that. But to be anal, PeeHaa, his choosing to reveal his name there doesn't mean you're empowered to do it elsewhere.
 
For the email I will say meh. I might have redacted that. For his name: wut? empowers to say somebodies name? wut?
 
Like I said, I was being anal. But I'm just very meticulous about privacy concerns and it prompted me to comment.
 
He has the facebook. He doesn't care :D
 
PeeHaa,I think you should remove the image now
 
7:40 PM
@Olli why/
 
And yes if a store like in my anecdote would publish my name I'll make them redact it and alert them to the possibility of suing them for breach.
 
@Olli That is not really a smart thing you did there
:P
You think notifying other rooms about that screenshot really helps?
 
mm
 
It's a bit like:
The Streisand effect is the phenomenon whereby an attempt to hide or remove a piece of information has the unintended consequence of publicizing the information more widely, usually facilitated by the Internet. The term is a modern expression of the older phenomenon that banning or censoring something often makes that item or information more desirable, and leads to it being actively sought out to a greater extent than it would have otherwise been. It is named after American entertainer Barbra Streisand, whose attempt in 2003 to suppress photographs of her residence inadvertently genera...
 
user1125394
dam I've been reading the last 2 hrs about pubsubhubbub, and this is a not much (at all) useful thingy
 
user1125394
except if you are making an app to crawl many different feeds
 
@cyril The name also doesn't really help :P
 
@MikeB How did that survive for that long?
 
@PeeHaa Dunno.. hakre must be slacking :p
 
7:49 PM
Shoot, need to fix one more test
 
@ircmaxell For? 50%?
@MikeB :)
 
nevermind, got it :-D
there's starting to get large blocks of "pass" tests...
 
nice!
 
user1125394
@ircmaxell sorry but can you tell me if it's just PHP in worse?
 
user1125394
7:56 PM
implementation*
 

« first day (811 days earlier)      last day (4141 days later) »