[colug-432] password survey

[Scott McCarty]

When I say keys, I mean hashed keys (per my article).

1. The private keys on a server are indeed hashed, so the user has to enter their password to decrypt them on the server, so that the session key can fire up. The attacker needs both remote access and an exploit to ssh to steal your password.  I am comfortable with that.

Client reverse auth can make this even more challenging.

1. Use of multiple servers for a single application has become much more common. Different keys for different servers (or classes), is do-able. Less is the problem of multiple users per system (in Yoda voice).

Finally, I know too much about security, but slowing projects down, is not fun to me. I prefer to get stuff done, fast.

Ssh keys truly offer both. Faster, more secure, more options (client auth).

As a final note, on speed and security. I am not sure what the group's opinion is on Lastpass, but I have developed a very effective personal security system based on last pass and Yubikey. This has literally changed my life ;-)

http://crunchtools.com/last-pass-with-yubikey


Sent from my Verizon Wireless 4G LTE smartphone

<div>-------- Original message --------</div><div>From: Rob Funk <rfunk at funknet.net> </div><div>Date:05/23/2014  7:38 PM  (GMT-05:00) </div><div>To: Central OH Linux User Group - 432xx <colug-432 at colug.net> </div><div>Subject: Re: [colug-432] password survey </div><div>
</div>On Friday, May 23, 2014 09:57:39 AM Rob Funk wrote:
> Scott McCarty wrote:
> > Personally, I do not consider hashing of any kind secure because it
> > is plausible to crack some of the passwords. Worse, it's a moving
> > target with ASICs and video cards cracking faster, and faster. I am
> > not trying to preach, but prefer keys, and session encryption for
> > anything production. By very nature, keys are two factor and revocable.

One more thing on this one: With keys, the server software needs access to 
the key, which means that anyone who can crack that software gets the key 
and therefore all the plaintext passwords. With hashes, the server software 
only gets access to individual plaintext passwords long enough to hash them, 
so there's no way to lose everything in one fell swoop.


> The problem with using symmetric encryption for passwords is that each
> account now has two ways of getting in: knowing/cracking the password,
> and knowing/cracking the encryption key. And unlike with hashing, if
> that encryption key is stolen then everyone's passwords are exposed.
> Generally it's not considered a good idea for anyone to get access to
> plaintext passwords. (Authentication protocols that involve passing
> the hashed password across the wire complicate things though, since
> the protocol does need access to the plaintext password.)

-- 
Rob Funk
http://funknet.net/rfunk

_______________________________________________
colug-432 mailing list
colug-432 at colug.net
http://lists.colug.net/mailman/listinfo/colug-432
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.colug.net/pipermail/colug-432/attachments/20140524/6c065baa/attachment.html