is he dead yet

[Slurpee]

I'm pretty sure I got away with hiding the fact that I don't know this, but do any of you (presumably vcr or pcat) understand salted hashes?

it makes no sense to me
like, okay, you use a one-way hash on the passwords so you can check if a password was inputted correctly without having to actually store it (which would be a security risk)
this makes sense to me because I understand hash functions and it explains why websites make you reset your password instead of just telling you what it is- even they don't know

but then,
you salt the hashes (and make the hashing function slow) so it's harder to brute force collisions, and users who use the same passwords won't show the same hashes, and the salts are generated pseudorandomly

how does that make sense?

the salts aren't user-facing, and, if they're generated pseudorandomly, they wouldn't be the same if generated again, so they have to be stored locally and associated with their respective user, right?
???
like.... ???????
if you know which user has which salt, you'd just append the associated salt to the password when checking for collisions, so how does that change anything?

I swear to god, my textbook does not explain this. they explain the process, and they just SAY that,

for a salt of length b bits, the number of possible passwords is increased by a factor of 2^b

dude, NO IT'S NOT

like if I said:

users are allowed to have one of these 3 passwords:
tic
tac
toe

but each user is assigned a random salt of 32 characters which is appended before the hash, and here is each of their unencrypted salts:
slurpee: BitchFuckBitchFuckBitchFuckBitch

hence, there are 3*2^256 or roughly 347.4 quattuorvigintillion possible passwords for slurpee ^_^

WHAT ARE YOU TALKING ABOUT
THERE'S STILL 3 OF THEM YOU LUNATIC

HERE THEY ARE:
ticBitchFuckBitchFuckBitchFuckBitch
tacBitchFuckBitchFuckBitchFuckBitch
toeBitchFuckBitchFuckBitchFuckBitch

LET ME COUNT THEM
1 2 3
OH LOOK YOU ADDED 0

[Slurpee]

at BEST, it would make it harder by a factor of, the number of users in the file
but it says that it deters an offline dictionary attack
HOW?
they're offline! they can take their time doing the entire list one at a time, and that's assuming they don't just want one

[RobClock]

It really bugs me that most password restrictions require more characters than in 'trustno1'

[pop-tart]

Know what I hate? Two factor authentication.

So like, if someone gets a hold of my phone and attempts to access one of the apps I use for work, they will text the phone to make sure it's me, even tho in that moment, it isn't.

[pop-tart]

And the person can enter the secret code and get access to all sorts of great reports like on shelf availability, Everseen execution, magnetic strip reader survey scores, and birthdays.

[RobClock]

My FUCKING internet is out again.



Ps Pop I see your game plan here but unless you aim to continue posting like this every day until you die, I will end up over taking you

[GreyClock]

I'm pretty sure I got away with hiding the fact that I don't know this, but do any of you (presumably vcr or pcat) understand salted hashes?

it makes no sense to me
like, okay, you use a one-way hash on the passwords so you can check if a password was inputted correctly without having to actually store it (which would be a security risk)
this makes sense to me because I understand hash functions and it explains why websites make you reset your password instead of just telling you what it is- even they don't know

but then,
you salt the hashes (and make the hashing function slow) so it's harder to brute force collisions, and users who use the same passwords won't show the same hashes, and the salts are generated pseudorandomly

how does that make sense?

the salts aren't user-facing, and, if they're generated pseudorandomly, they wouldn't be the same if generated again, so they have to be stored locally and associated with their respective user, right?

???
like.... ???????
if you know which user has which salt, you'd just append the associated salt to the password when checking for collisions, so how does that change anything?

I swear to god, my textbook does not explain this. they explain the process, and they just SAY that,

for a salt of length b bits, the number of possible passwords is increased by a factor of 2^b

dude, NO IT'S NOT

like if I said:

users are allowed to have one of these 3 passwords:
tic
tac
toe

but each user is assigned a random salt of 32 characters which is appended before the hash, and here is each of their unencrypted salts:
slurpee: BitchFuckBitchFuckBitchFuckBitch

hence, there are 3*2^256 or roughly 347.4 quattuorvigintillion possible passwords for slurpee ^_^

WHAT ARE YOU TALKING ABOUT
THERE'S STILL 3 OF THEM YOU LUNATIC

HERE THEY ARE:
ticBitchFuckBitchFuckBitchFuckBitch
tacBitchFuckBitchFuckBitchFuckBitch
toeBitchFuckBitchFuckBitchFuckBitch

LET ME COUNT THEM
1 2 3
OH LOOK YOU ADDED 0

I will attempt to answer that, because it seems like mild fun for some reason. (Note: I might not have even understood the question.)


From what I understand it's done to counter rainbow tables, not necessarily brute forcing? It would mean that, in the case of a stolen database, someone would have to compute tables for every possible salt for each individual password, because it's all unique and random. I mean: "The SHA2-crypt and bcrypt methods—used in Linux, BSD Unixes, and Solaris—have salts of 128 bits. These larger salt values make precomputation attacks against these systems infeasible for almost any length of a password. Even if the attacker could generate a million tables per second, they would still need billions of years to generate tables for all possible salts." Too much data, but only in the case of hacker v (large) database not v single user? So I think your second post is right in that regard.

Compare that to say MD5, apparently the hash of "password" is:
5f4dcc3b5aa765d61d8327deb882cf99
So you can just look that string up in any MD5 database and maybe get a hit? I think that might be a good illustration of the value of salt?

If your password is "password" and they brute force "password", yes any amount of salt isn't gonna do shit.

If I'm understanding any of this correctly it might be a directional thing? Like brute force is from the outside in, rainbow table is from the inside out? Essentially working backwards to reconstruct the password? But yeah, in your example if you know the password is "tic" and the salt is " BitchFuckBitchFuckBitchFuckBitch", then there's not much point to any of it? " tic"  is what you were after in the first place, right?


But I'll let the people who actually know what they're talking about answer now, ;)

[RobClock]

I still don't know shit about coding but goddam waiting around to hear from ISP technicians is annoying. It's five to noon now and they could still come by anytime from now to 4pm and I have to sleep before work for fuck sake.

I got two coats of the sealant down on my countertop so far though and it's looking pretty good so that's nice

[PhantomCatClock]

you aren't just appending the salt, you're using the salt to en/de crypt it as well (and it can be a little more of a pain in the ass if you store them separately but most of the time they are just prepended

you generally want the salt to be the same length as the resulting hash, too, but I don't think bcrypt does this exact method

the gist of grey's post is the big part of it. lots of hashing algorithms, even proprietary ones, are just known. Leaked or otherwise. Someone with a powerful computer just computes every password and you can buy tables of the resulting hashes online, then translate every password off of those. If every user has a unique salt, that user would need a similar table just for their one password. New salt every time they generate a new password? You maniac, you've done it again.

[PhantomCatClock]

what did i even come on to post

[PhantomCatClock]

oh yeah automatic doors.


they always fucking go insane and i've seen technicians from at least two different automatic door companies. I've seen these technicians in different stores, across three different time zones and every FUCKING one does this exact thing when you call them in when their insane ass door:

• opens and shuts over and over, nonstop, without any input
• stays open without any input
• stays closed despite being set to "auto" and having a lot of movement input
• all of the above during the day, where it could be false positives from the sun (and they could at least alter the sensor's resistance)
• all of the above during the night, where it simply put needs to be god damn fixed



they all


have the same


visits.






"Well, I've done absolutely nothing and now I'm out of ideas. Keep submitting reports every time the door goes fucky."

[PhantomCatClock]

)




slurpee i'm sorry i never closed that parenthesis so have this so that you may continue your day without anxiety




but yeah if your book is like "here, use bcrypt. it good, this why:" then okay, i can see why it didn't go into detail. if it's like, telling you how to use a encryption library to do this yourself, then FUCK THAT BOOK high five slurpee high five me right now come on let's go

[VCRClock]

But I'll let the people who actually know what they're talking about answer now, ;)

Would you let a master of art history explain a computer science concept to you? Or would you rather trust a web forum administrator?

Use bcrypt, it good.

[Slurpee]

high five slurpee high five me right now come on let's go

[Slurpee]

it's uh
theory
theory book
no real programming, just making sure you understand concepts like attack surface, protocol, firewalls, shit like that

and the instructor mostly just wanted us to know enough to speak intelligently about them. we toyed around with netmap and wireshark but none of it was on the final
I think it's one of those classes that only exist to prep you for graduate-level work that most of us aren't going to be going on to

[RobClock]

In my high school tech class when we got to web development the teacher waited for us to file in, wordlessly turned off the lights, turned on the projector and sat stone faced in absolute silence while he played a static image YouTube video of the song "dreamweaver"

[Slurpee]

In my high school tech class when we got to web development the teacher waited for us to file in, wordlessly turned off the lights, turned on the projector and sat stone faced in absolute silence while he played a static image YouTube video of the song "dreamweaver"

lol

[Slurpee]

I have another question, this one is a two-parter and has nothing to do with technology

1) is there a law or something that says porn companies aren't allowed to depict incest between blood relatives?
I think I just assumed that that's why pornhub and all its sister sites are filled with the prefix "step-", but I guess it's possible that the owner of pornhub is trying to send a message to his stepmom

2) if there is such a law, is there any way the title "fooling around with stepbro then stepdad fucks both" is not breaking that law? if they're stepbros to each other, then by definition shouldn't the stepdad just be dad to one of then?
I'm not sure if it's addressed in the video because I didn't click on it and only realized this later
but if it was illegal then I guess I admire their ingenuity in hiding it behind a logic puzzle

[PhantomCatClock]

netmap

IS THAT WHAT NMAP STOOD FOR THIS WHOLE TIME


they recently stopped making root the default user on kali (you probably knew it as backtrack in your 4chan days don't think i don't know about those) which is a great way to find out nmap is like the only thing that requires root

[PhantomCatClock]

and not necessarily. take a look at this family tree of stepbro fucking:




DAD - MOM - REMARRIED DAD
       V     |  V
     BRO   | BRO
              |_________THIRD DAD - FIRST WIFE MOM
                             V                  V
                           BRO               BRO


it's implied, but common, that the far left bro would be fucking the far right bro, who is not related at all. Now, for the unrelated stepdad, we need to get into some advanced pornhub genealogy but you're a smart guy so this should point you in the right direction, at least.