{"action":"opened","issue":{"url":"https://api.github.com/repos/AndrewBelt/hack.chat/issues/119","repository_url":"https://api.github.com/repos/AndrewBelt/hack.chat","labels_url":"https://api.github.com/repos/AndrewBelt/hack.chat/issues/119/labels{/name}","comments_url":"https://api.github.com/repos/AndrewBelt/hack.chat/issues/119/comments","events_url":"https://api.github.com/repos/AndrewBelt/hack.chat/issues/119/events","html_url":"https://github.com/AndrewBelt/hack.chat/issues/119","id":208721803,"number":119,"title":"Salt Reuse + Hash Collisions","user":{"login":"LandonPowell","id":8799631,"avatar_url":"https://avatars.githubusercontent.com/u/8799631?v=3","gravatar_id":"","url":"https://api.github.com/users/LandonPowell","html_url":"https://github.com/LandonPowell","followers_url":"https://api.github.com/users/LandonPowell/followers","following_url":"https://api.github.com/users/LandonPowell/following{/other_user}","gists_url":"https://api.github.com/users/LandonPowell/gists{/gist_id}","starred_url":"https://api.github.com/users/LandonPowell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LandonPowell/subscriptions","organizations_url":"https://api.github.com/users/LandonPowell/orgs","repos_url":"https://api.github.com/users/LandonPowell/repos","events_url":"https://api.github.com/users/LandonPowell/events{/privacy}","received_events_url":"https://api.github.com/users/LandonPowell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-02-19T14:46:31Z","updated_at":"2017-02-19T14:46:31Z","closed_at":null,"body":"The Hash function you're using for your 6 char tripcodes is comically vulnerable. \r\n\r\n## Salt Reuse:\r\n### Attack to gain server-side salt:\r\nGenerate 10 legit hashes yourself, which you will know the password (but not the salt) to. \r\n\r\nBrute forcefully generate salts until you find one which allows all 10 of your password hashes to resolve correctly. \r\n\r\nThe attacker only needs to know that one doesn't work before skipping to the next possible salt. \r\n\r\nIf your sysadmin fails to have a randomly generated salt, you can substitute brute-force for dictionary.\r\n\r\n## Hash Collisions:\r\nCollisions alone nearly guarantee someone to guess every other user's trip after about 16 billion runs of the function. \r\n\r\n## Simple Solution:\r\nGenerate salt based on (username + config.salt). Also has issues, but at least now every user has a salt of their own.\r\n\r\n## Good Solution:\r\nGenerate a salt for each username and save it locally.  Authenticate users properly, not by telling the end-user to read and remember a bunch of random characters for each user. \r\n\r\n## Useful Information:\r\nhttps://crackstation.net/hashing-security.htm#salt"}}
{"actor":{"display_login":"LandonPowell"}}