this post was submitted on 09 Aug 2023
72 points (100.0% liked)
Asklemmy
43125 readers
1312 users here now
A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- [email protected]: a community for finding communities
~Icon~ ~by~ ~@Double_[email protected]~
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Just want to add some detail to what everyone is saying about passwords. From what I understand, by default, Lemmy uses the bcrypt hashing function to store passwords. This is a fantastic choice. The great thing about hashing a password is that there is no way to go from the hash back to the password. It's mathematically impossible, since the process loses information. This is different from encryption where there is a mathematical way to recover the original data from the ciphertext.
So great, no recovering passwords! Well...Not exactly. While there is no way to calculate the password from the hash, the neat thing about hashing algorithms is that the same input, run through the same function, will always produce the same output. And since we know Lemmy uses bcrypt, and a sufficiently motivated attacker could look at the code and figure out all the variables that goes into the bcrypt function in Lemmy, an attacker can know exactly how your password was hashed. They can make a guess at your password, run it through the function and see if that matches the hash stored in the database (this is actually how you are authenticated when logging in). If they do that a lot of times, they might be able to guess your password this way. This is basic brute forcing of a password. and there are pre-built tools to do this.
Extending that brute force attack further. People are bad at picking passwords. Most peoples' passwords follow similar patterns and have similar words in them. If you get such a list of words and use it to make up the guesses using common patterns, this can greatly speed up the guessing of passwords. And, wouldn't you know it, this also has pre-built lists and tools to do. It's dead simple. Take a class on hacking and you'll likely be doing this on day 1. Day 2 if the instructor eats up a lot of time going over the syllabus.
So, what's the defense against this? Well, two things:
That is a lot of words to say ‘they can’t see your password, but they can try to guess it. Make a secure password and you won’t have any problems’
That's a fair critique. However, I find the advice "Make a secure [unique] password and you won’t have any problem" is often given, without any explanation as to "why" that advice is given. As someone who likes to know the "why" behind things like this, I like to give that detail as well.