[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <45F2052C-3116-47F7-9EBE-9CF47C2B316D@goldmark.org>
Date: Fri, 10 Aug 2012 13:46:09 -0500
From: Jeffrey Goldberg <jeffrey@...dmark.org>
To: john-dev@...ts.openwall.com
Subject: Re: SRP
I have to confess about being really confused by what Blizzard said about SRP. SRP is about securing a peer to peer key exchange. It has nothing (as far as I understand) to say about how passwords are stored.
So SRP may be used between Blizzard's front-end and back-end servers to prevent evil done through sniffing or tampering with that interchange. But the backend server, still hashes (or not) the user data as it sees fit. A breach of the back-end server (as seems to have happened here) makes the use of SRP irrelevant.
The SRP documents *recommend* that the back-end store passwords using PBKDF2, but it is something outside of the domain of the actual protocol. So only Blizzard and the people who have the data know at this point how the data is hashed.
Cheers,
-j
On 2012-08-10, at 12:35 PM, Solar Designer <solar@...nwall.com> wrote:
> Hi,
>
> Here's our opportunity to start supporting SRP verifiers:
>
> http://www.opine.me/blizzards-battle-net-hack/
> http://www.reddit.com/r/netsec/comments/xzlj0/srp_wont_help_protect_blizzards_battlenet/
> http://www.reddit.com/r/netsec/comments/xywby/blizzard_compromised_some_battlenet_user_data/
> http://www.reddit.com/r/gaming/comments/xypw2/blizzard_security_update/c5qx770
> http://arstechnica.com/gaming/2012/08/hackers-collect-significant-account-details-from-blizzard-servers/
> http://sea.blizzard.com/en-sg/securityupdate.html
> http://linux.slashdot.org/comments.pl?sid=2957621&cid=40545659
> http://www.redhat.com/archives/pam-list/2000-September/msg00022.html
> http://www.redhat.com/archives/pam-list/2000-September/msg00069.html
>
> Anyone?
>
> Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
