Comments for clyon's blog

Comment on Mozilla Summit – “Are We Being Secure?” and are password(s) safe? by thornet

thornet — Tue, 02 Aug 2011 14:40:37 +0000

Super cool and educational effort. We’d love to throw together a “Wall of Sheep” for the Mozilla Festival in London, Nov 4 – 6: http://mzl.la/festivaldate

Is the code available for this, or could you point us to someone who could help install?

Thanks, Chris!

Comment on Mozilla Summit – “Are We Being Secure?” and are password(s) safe? by joe

joe — Tue, 14 Jun 2011 20:22:40 +0000

This looks interesting. Any idea when the code will be up?

Comment on Moving on… by Erin Wilson

Erin Wilson — Tue, 31 May 2011 23:05:58 +0000

Chris,

Congratulations on your move! I’m sure as tough of a decision as it maybe, it was a good one.

I originally found you on LinkedIn while doing a project around trying to find good senior management to reach to in regards to a specific candidate. Then I found your twitter, then read your timeline, then your blog, and now here I am…

My request is probably not appropriate but minimally I could congratulate you before leaving your blog.

If you need anything in the future please do not hesitate to reach out for any reason any time.

Talk soon,
EW

Comment on SHA-512 w/ per User Salts is Not Enough by me

me — Sat, 28 May 2011 15:01:23 +0000

You can also use iterations to the process to slow down the attacker.

Comment on Moving on… by Chris Lyon: Moving on… | Firefox Latest News

Chris Lyon: Moving on… | Firefox Latest News — Fri, 27 May 2011 21:30:56 +0000

[...] Planet Mozilla No Comments May 27, 2011 By Giovanni Panasiti in Planet Mozilla Tags: Chris, Lyon, Moving, on… « Demoparty coming to Oslo [...]

Comment on SHA-512 w/ per User Salts is Not Enough by Chris Lyon

Chris Lyon — Sat, 14 May 2011 19:45:33 +0000

We are working on the details for this, not sure how much of this we will disclose, hence the generic comment.

Comment on SHA-512 w/ per User Salts is Not Enough by Jonathan Watt

Jonathan Watt — Sat, 14 May 2011 02:08:06 +0000

“Instead this data is stored on the operating system within a protected file.”

Will this still be within the profile directory, or will we no longer be able to copy a profile directory from one computer to another and have it just work?

Comment on SHA-512 w/ per User Salts is Not Enough by Chris Lyon

Chris Lyon — Wed, 11 May 2011 16:49:41 +0000

We are not trying to over complicate it, what we are gaining is a separation of who can unlock the hashes. A good example of this is that only the system admins have the keys to unlock the hashes and the dev teams don’t. So if the database wasn’t moved from a prod to a dev environment correctly, it won’t work.

So we are just forcing the issue.

and yes, agree, hashes are simply just weak.

Comment on SHA-512 w/ per User Salts is Not Enough by Heikki Toivonen

Heikki Toivonen — Wed, 11 May 2011 16:31:44 +0000

Salted hashes are indeed a problem, but not because the algorithm is known or salt is known. They are simply too easy (=fast) to brute force attack if you get the database.

bcrypt and similar solve this problem by making brute force attacks infeasible because nobody has the computational power to do it. I think you may be overcomplicating this by adding a layer above bcrypt.

See http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html

Comment on Passwords, how many do you have? by Jane Finette

Jane Finette — Thu, 30 Dec 2010 10:27:43 +0000

Chris, last year we began the Mozilla Consumer Education project working on researching and learning about what new topics are of most interest to ordinary web users, and furthermore what types/formats of information best resonate with this audience. One was specifically around “passwords” – take a look at my blog post here: http://janefinette.com/post/1675391804/consumer-education-at-mozilla

Richard Milewski wrote and published this information surrounding the creation and use of safe passwords. He broke it down into three areas:

Part 1: covers common mistakes that lead to insecure passwords,
Part 2: shows how to use memorable phrases to make secure easy-to remember passwords,
Part 3: has ways to get your browser to help manage your passwords, and sync them between your browsers on different machines and mobile devices.

There’s also a fun video! You can see a full overview at his blog here: http://richard.milewski.org/archives/734