gotwatcher3412431 Archive

Upvotes	Title	Category	Author	Subreddit	Date (UTC)

Upvotes	Comment on	Subreddit	Date (UTC)
0	A note on the backup forums Your reluctance to disclose how passwords are stored is deeply troubling. Kerckhoffs's principle says that knowing how a properly designed system operates should not compromise its security. Your reluctance to disclose your security measures can only indicate either ignorance or malice, and I hope it's the former.	/r/TheRedPill	19/08/15 09:09 PM
-1	A note on the backup forums I doubt you know what you're talking about. scrypt (and its spiritual predecessor, bcrypt) are designed to be very resource-intensive, making brute force infeasible. (It's like PBKDF2.) Obviously, brute-forcing SHA1 is fast because it's a function designed to be fast. While it's possible to compute every possible bcrypt function (it's deterministic, after all), the function is designed to make that computationally infeasible. bcrypt and scrypt have built-in salt. Your scrypt hit piece was also t…	/r/TheRedPill	19/08/15 09:08 PM
25	A note on the backup forums Salting the passwords isn't enough. A plain concat(salt,SHA1(concat(salt,password))) is still pretty easy to crack in the event of a database compromise because hardware to execute standard hash functions is so fast. What you really want is something like scrypt, something designed to combat large-scale brute force attacks.	/r/TheRedPill	06/08/15 02:21 PM