Geez, Guys, Salt Your Hashes

LinkedIn confirms that they have had a breach, and PC World has a good discussion. Linkedn has certainly not been following best practices, though we've all seen stupider.

• Stupider: storing the user passwords. Any site that can come up with your current password is run by  bozos.

According to the PC World article, LinkedIn lost a file containing 6.5M hashed passwords. They used SHA-1 to hash the passwords. SHA-1 is not a great hash algorithm, with NIST recommending it be phased out, but that is not the problem here. The problem is that the the hashes were unsalted. This means that a brute force password guessing program can guess a password, hash it, and see how many hashed passwords it matches. People are bad at choosing passwords, so many passwords are used by multiple people.

Salting involves generating a random number for each password. Then the random number and password are concatenated, and then hashed. This means that 

1. most likely hashes will be unique, and
2. even if two hashes are the same, they almost certainly do not correspond to the same password.

For this to work, the random value (the salt) for each password must be stored with the hash, and then when a user logs in the hash and the salt are retrieved, the salt is added to the password the user types, and then the result is hashed. If it matches, the login attempt succeeds.

Thanks to NPR for reporting this and to PC World for explaining what happened.

2011 CCSC-E Marymount University

Last week I attended CCSC-E 2011 at Marymount University in Alexandria, VA. The location was great, and the venue was very good. The conference was also very good.

One of the highlights was proximity to the Ballston Metro stop. Admittedly the DC Metro System isn't what it used to be, a darker, dingier, smellier, noisier shadow of its past self. Maybe a sense of community will return to this country someday and people will realize that Oliver Wendell Holmes, Jr., was right when he said taxes are the price of civilization. Anyhow, the first day I drove just a few miles to the Halethorpe MARC station and caught a train to DC. Saturday I drove down to the Greenbelt Metro Station.

But at the conference itself, there were three highlights:

1. "Going Green with Computing" with panelists Tom Camerlinck, CIO, Greenpeace; Dave Deal, CEO, Community IT Innovations, Inc.; and Jeff Porter, IT Infrastructure Director, Fairfax County, VA. This is an area of growing importance with quite a few organizations, including Google, taking it seriously. For many organizations, the point is to save money and saving energy and materials will effectively do just that.
   
2. A tutorial, "Introduction to Cryptography" from Seth Bergmann, Rowan University. I went to a similarly-title tutorial at CCSC Central Plains a few years ago, and both were good. I don''t know that I learned anything new about crypto here, but it's always good to attend these things to see material I sometimes teach well-presented by someone else.
3. Finally, a workshop entitle "How To Deliver a Gentle Introduction to LR Parsing" by David Middleton from Arkansas Tech. Obviously in an IS department I won't be teaching compilers any time soon, but it is an interesting topic and was well-presented. Middleton and Larry Morell presented a workshop entitled "Applying compiling concepts throughout the computing curriculum" at CCSC Midsouth in 2003, which was very good (admission: Larry Morell was a CS prof at W&M when I was an M.S. student there). I think those of us who stayed till the end came away with a better appreciation for LR parsing and a solid introduction to teaching LR. It was long for a late Saturday afternoon, but worth the time.

I enjoyed CCSC 2011 much more than the 2010 instantiation. In 2010 there was an interesting robotics and vision presentation by Grant Braught of Dickinson, but otherwise a fairly bare cupboard leaving me to wonder if CCSC was moving away from CS. Kudos to the 2011 committee and to Marymount University.