2

鉴于暴雪最近发生的数据泄露事件，我想询问一下暴力破解和加盐哈希密码存储的问题。

Ars Technica 有一篇很好的文章，解释了为什么即使是暴雪存储的加盐哈希密码也可以在短时间内被破解。

由于使用了加盐和散列，我们知道暴力攻击是破解“复杂”密码的唯一可行方法（字典/纯字密码很简单）......但是 Ars Technica 提出了一个很好的观点，即巨大的计算能力的提高（本地和云端）使暴力破解更加可行。

对于一个网站，Jeff Atwood 指出，强制延迟身份验证尝试实际上可以阻止暴力破解尝试……但在暴雪破坏的情况下，黑客对数据库具有物理控制权，因此不能施加这样的可访问性限制。

因此，Jeff 还建议使用密码短语，因为暴力攻击者面临的熵增加......但是随着计算能力变得更大和更容易获得，这最终也会有效地消失。

所以问题是：由于计算能力的增加，可以实施哪些不受攻击的蛮力保护方案？

通常会考虑两阶段身份验证，但我听说其中一些算法也被破坏了，而物理身份验证器可能具有静态算法，因此一旦被破解，所有用户都会受到攻击。

适用于整个身份验证数据库的预定滚动盐怎么样？这会增加很多开销，但即使在物理数据库泄露的情况下，它似乎也能保证安全。

4

1 回答 1

1

Security is a combination of a few things (there is much more than this list, but rather than turning this post into a book, I'll keep it at these for now):

  • Encryption - complexity; making it difficult to know what the original content is
  • Obfuscation - unclear/protected; making it difficult for other scripts/users to know or guess how your security scheme works.
  • Intrusion Prevention/Response - determining when a security breach (or attempted breach) has occurred, and responding to the incident

Encryption will be things like hashing, salts, SSL, keys, etc. Obfuscation will be things like steganography, using rotating salts, separating the passwords off into another server that no script can access, etc. Intrusion Prevention/Response will be things like rate limiting, delays, shutting down servers once the breach is made known, etc.

Now looking at your question: What brute-force protection schemes can be implemented that aren't vulnerable due to increasing computation power?

My answer: none. Unless someone builds a quantum computer or a mathematician writes an expansion to group theory in a way that would blow all of our minds out of our heads, then any and all "brute-force protection schemes" will be vulnerable to increasing computational power (especially distributed processing, such as cloud servers or bot-nets).

It seems like your fear is the case of Blizzard, where the database had been accessed, and the hashed passwords were seen by the hackers. If someone has the hash, and knows your salts/hashing procedure, then it's only a matter of time before they can get the password. At this point, we are talking only about encryption, because everything else is known and/or moot.

It's a matter of math: the longer and more complicated the password, that's increasing orders of magnitude, and the problem becomes an exponential with each added character. But if you exponentially increase the computational power of the brute-force algorithm, you're back to square one.

If a hacker gets a hold of the hashes that are stored in your database, then immediately lock the database, figure out how they got in, fix that security hole, and add a step to your authentication procedure, update the database with the new authentication procedure and turn everything back on.

In other words, make sure your authentication server/database is secure on every level so that hackers can't get access to it.

If you just want to "buy more time", then add complexity. But keep in mind that this doesn't make your database more secure. It would be better to analyze how to lock the database down to prevent someone from getting the hashes in the first place.

于 2012-08-13T22:19:05.613 回答