Date: Thu, 13 Dec 2012 21:22:50 -0800 From: Steven Alexander <pdp11hacker@...il.com> To: crypt-dev@...ts.openwall.com Subject: Re: Intentionally Increasing Collisions in Password Hashing Algorithms Matt, So that's a longer way of saying that I really hope I'm not wasting > everyone's time. > Quit worrying about that. One of the benefits of entertaining crazy ideas is that it can help us to look at things from new angles. The discussions/analysis could end up being valuable even if your idea isn't. Then there's the basic question about how much is it worth to an > attacker to be able to break into an account? > That really depends. For a banking/payment website, the account itself has value based on what the attacker can extract from it. For other sites, the value of the accounts probably comes from being able to log in with the same information elsewhere. The attacker doesn't care about your actual Gawker account but if he can use it to log in to your bank, PayPal or WoW account, it has value. Of course, this hits on what you were trying to accomplish with the truncated hashes. If the Gawker account can't be used to predict one of those others, it has no value. I don't know if an attacker would be interested in having a small number of low value accounts. It probably depends on how much effort is required to turn one into a high value account. If 10% of Gawker accounts can be converted into a higher value account with just a few tries at different sites, that gives them some potential value. If the success rate is .01%, then the individual value is low by any measurement. I'd be interested to know more about how stolen accounts are actually used and traded. How often are the initial attackers actually using the accounts and how often are they selling them to a third party? Are the attackers and sellers both involved in trying to compromise additional accounts with known credentials or is it primarily one or the other? "How many guesses can an attacker make?" > A lot of sites have lockout policies. If you lock the account after 3 tries or 10 tries, the access-by-collision issues becomes almost moot (on a per account basis anyway). Even with temporary lockouts or delays that limit the attacker to 100-300 guesses per day, having a chance of collision between 1/2k and 1/8k could be acceptable. The better question might be, "how many guesses *do* attackers make?" The GW2 article said that they were saying targeted guessing with only one to a few guesses per account. If that's the case, then the idea of truncating isn't helpful; you need blacklisting and/or two factor authentication. BTW, I read your "Testing Metrics..." paper. Have you done any testing to see how well blacklisting would help against offline attacks? -Steven Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.