Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Aug 2012 13:46:09 -0500
From: Jeffrey Goldberg <jeffrey@...dmark.org>
To: john-dev@...ts.openwall.com
Subject: Re: SRP

I have to confess about being really confused by what Blizzard said about SRP. SRP is about securing a peer to peer key exchange. It has nothing (as far as I understand) to say about how passwords are stored.

So SRP may be used between Blizzard's front-end and back-end servers to prevent evil done through sniffing or tampering with that interchange. But the backend server, still hashes (or not) the user data as it sees fit. A breach of the back-end server (as seems to have happened here) makes the use of SRP irrelevant.

The SRP documents *recommend* that the back-end store passwords using PBKDF2, but it is something outside of the domain of the actual protocol. So only Blizzard and the people who have the data know at this point how the data is hashed.

Cheers,

-j  

On 2012-08-10, at 12:35 PM, Solar Designer <solar@...nwall.com> wrote:

> Hi,
> 
> Here's our opportunity to start supporting SRP verifiers:
> 
> http://www.opine.me/blizzards-battle-net-hack/
> http://www.reddit.com/r/netsec/comments/xzlj0/srp_wont_help_protect_blizzards_battlenet/
> http://www.reddit.com/r/netsec/comments/xywby/blizzard_compromised_some_battlenet_user_data/
> http://www.reddit.com/r/gaming/comments/xypw2/blizzard_security_update/c5qx770
> http://arstechnica.com/gaming/2012/08/hackers-collect-significant-account-details-from-blizzard-servers/
> http://sea.blizzard.com/en-sg/securityupdate.html
> http://linux.slashdot.org/comments.pl?sid=2957621&cid=40545659
> http://www.redhat.com/archives/pam-list/2000-September/msg00022.html
> http://www.redhat.com/archives/pam-list/2000-September/msg00069.html
> 
> Anyone?
> 
> Alexander

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ