111 reputation
6
bio website robinwinslow.co.uk
location Nottingham, United Kingdom
age 30
visits member for 1 year, 2 months
seen Nov 7 '13 at 9:24

I'm a web developer at Canonical.

I have a blog about web dev, politics and other things.

I'm interested in UX, client- and server-side development, code architecture and microformats.

I'm not a fan of intellectual property, and I love freedom of information and open-source.


Sep
27
awarded  Commentator
Sep
27
comment Could completely public passphrase hashes ever be reliably secure?
Sorry I've replaced "password" with "passphrase" in the original question to satisfy your pedantry. See ThomasPornin's answer for a discussion of the security of a 44-bit passphrase.
Sep
27
revised Could completely public passphrase hashes ever be reliably secure?
Change "password" to "passphrase"
Sep
27
comment Could completely public passphrase hashes ever be reliably secure?
To clarify - I don't think it's valid to apply your PIN study to passphrases because numbers are hard for humans and easy for computers, whereas words are easy for humans and hard for computers.
Sep
27
comment Could completely public passphrase hashes ever be reliably secure?
Something else just occurred to me. Presumably when you get hold of a table of password hashes the first thing you check for is low-hanging fruit - check all hashes against common passphrases like "password", "god", "iloveyou" or whatever. Presumably this is a fundamental vulnerability with public passphrase data - easily guessable passwords would be immediately found, rendering those accounts insecure. And there would inevitably be some. Is that not the case?
Sep
27
comment Could completely public passphrase hashes ever be reliably secure?
Okay so it's not so scalable at a 1-second algorithm. But presumably we could find a fairly happy medium. Since 44-bit at 1-second = 1400 years, so we clearly have some leeway. If I were to require 12-character passwords, how much entropy could I expect, on average? And then how fast could I make my algorithm if I wanted to keep expected brute force-able time above 10 years?
Sep
27
comment Could completely public passphrase hashes ever be reliably secure?
You employ a study about PIN numbers to make an argument about plain language passwords. You might not be able to remember the correct order for "correct horse battery staple" but then you didn't come up with it. If you were to pick a four-word password I think you'd probably pick something you can remember. I'd be very interested to see a study on the average entropy of user-chosen 10-character passwords, for example. I'm sure lots of people would use common phrases, like "I love you" = lower entropy. But that's still not terrible.
Sep
24
comment Could completely public passphrase hashes ever be reliably secure?
Right, so if I were to use a slow hash that takes 1 second on my server, surely a 44-bit password would be perfectly secure enough even with a public hash.
Sep
24
comment Could completely public passphrase hashes ever be reliably secure?
Are you saying that for reliable security, human readable passwords must be at least ten words long? Holy crap we're all doomed. So in this day and age, with the fastest GPU-based cracking techniques, how long would it take to brute-force a password with 44 bits of entropy encrypted with a slow hashing algorithm and a salt?
Sep
24
awarded  Supporter
Sep
24
comment Could completely public passphrase hashes ever be reliably secure?
@Reid I suppose my question should have been something like "what problems can you see with authentication within an application with 100% open and public source code and database data"
Sep
24
comment Could completely public passphrase hashes ever be reliably secure?
@Reid Yes I see your point - it's "what all the fuss is about" so it should be possible. So what I'm really asking is - if I wanted to have a 100% open app - all the source code and all the data publicly is available (not just through leaks - literally anyone can just download it) - could I still offer reliable authentication. I thought there might be a difference - in terms of the types of possible attacks - between a leaked set of password hashes and a publicly available one.
Sep
24
awarded  Student
Sep
23
awarded  Cleanup
Sep
23
revised Could completely public passphrase hashes ever be reliably secure?
rolled back to a previous revision
Sep
23
awarded  Editor
Sep
23
revised Could completely public passphrase hashes ever be reliably secure?
deleted 157 characters in body
Sep
23
comment Could completely public passphrase hashes ever be reliably secure?
@owlstead If you can dig it out I'd be interested to read it. All I found when Googling was this SE question and the consensus there seems to be that Randall's reasoning is largely accurate.
Sep
23
asked Could completely public passphrase hashes ever be reliably secure?
Sep
23
awarded  Autobiographer