Pages:
Author

Topic: Coinchat doesn't salt or use a strong hash algo - page 2. (Read 32223 times)

legendary
Activity: 1890
Merit: 1086
Ian Knowles - CIYAM Lead Developer
As I stated before 99.9% of programmers use the same template for hashing and salt handling things across all sites. I think the question you should be asking, is why he doesn't prove that this isn't true, I have already shown proof that this could be an issue. Also if it wasn't an issue why is he extorting my ratings to have it removed? Makes you wonder.

A statistic that you (once again) pulled out of your arse (or ass if you're an American).

He does not need to prove your "accusations" any more than you would need to prove his - whatever he does you will not believe him (and I am pretty sure the same would apply in reverse).

You have only proof of one website so you should change the topic to show that.
sr. member
Activity: 336
Merit: 250
Cuddling, censored, unicorn-shaped troll.
If it is a completely different thing then your posting about insecure passwords is just as much a "completely different thing".

Where is your proof that the same code is being used on all the websites?

He has no proof. He's been asking for TF to provide him with proof it is not the case, by letting him check the CoinLender database.
And since then, they're just trying to see who's the most stubborn. This is really becoming stupid.

TF was using static salt on CoinLender, he admitted it, and also admitted this was bad practise.
He then claimed it was fixed, and a "per user" random salt was use to rehash all the passwords.
I doubt this could be a lie.

CoinChat does not use any salt, so is very vulnerable to rainbow attack.

So the conclusion of all this is:
- Don't use CoinChat
- If you do, make SURE you don't use your CoinChat password ANYWHERE else.

/thread
legendary
Activity: 1890
Merit: 1086
Ian Knowles - CIYAM Lead Developer
That is a completely different thing. That is after DeathAndTaxes brought up the password salt issue, which he claims to fix on one site.

If it is a completely different thing then your posting about insecure passwords is just as much a "completely different thing".

Where is your proof that the same code is being used on all the websites?
legendary
Activity: 1890
Merit: 1086
Ian Knowles - CIYAM Lead Developer
So another site that is 2 different bad security practices spread to two different sites.

I can't really be bothered to go through all the previous posts but you did post this (above).

Clearly it is not the *same* problem from the same website so your OP does have a problem when it says as much (the problem is not one of facts now but one of attitudes AFAICT).
legendary
Activity: 1890
Merit: 1086
Ian Knowles - CIYAM Lead Developer
Also I have worked in the industry for long enough that when one problem is found, it is found in every project after it.

Really that does not make sense as you even admitted that he has "improved through learning" his security management in his projects.
legendary
Activity: 1890
Merit: 1086
Ian Knowles - CIYAM Lead Developer
How is this FUD? So it isn't FUD when he claims that he can hack my site, extorts me to remove bad post, or when he claims I am untrustworthy when I never even did a trade with him? Yet I point out that if one site and alert users has a huge security flaw, which is true from his own words by the screenshot, that is FUD. Cause that makes so much sense.

Hmm... can you calm down? I do not dispute that you found a problem with one of his websites - and hacking claims were nothing to do with what I mentioned.

The problem (as I see it) is that you have said that *all his websites* have the same flaw and you have not proven that (I am pretty sure that he has admitted the problems with the one site).

It looks more like there is some sort of bad blood between you guys rather than just some information about security.
legendary
Activity: 1890
Merit: 1086
Ian Knowles - CIYAM Lead Developer
I think that if gweedo only has *proof* of the one site not having secure passwords then the title of this topic should be changed (otherwise it really is FUD). To say you "suspect all other sites" run by the same person have the same problem is really a bit of a stretch if you have no proof.

Apart from that guys I think that this topic is doing *nothing* for the benefit of the Bitcoin community (although I am sure many are enjoying the *drama* of it all).
vip
Activity: 1316
Merit: 1043
👻
gweedo: the issue is with you spreading FUD. The only site not salted is CoinChat but despite multiple denials you somehow assume it is for all my other sites, which is the FUD and lies part.

That's what is reasonable but obviously people will ho "a chat room just hashes? Everything is properly done for sites that actually handle money?" But I guess that reaction wasn't what you are looking for.

If you do not get this part, you're dense or you are just here to pick a fight.
legendary
Activity: 1134
Merit: 1118
So now we have FUD from both TF and gweedo.

Oh, for fuck sake, guys. Trying to paint each other red, there is always some kind of drama on this forum. This fucking FUD does not improve your reputation, it just makes you look like a dick.

@gweedo: I would trust TF with my bank account details, I'm 99% sure that he will never scam or access passwords for malicious use. Especially as people do have his personal info. He also DOES hash and salt his passwords, he doesn't need to give you his source code. Hell, I wouldn't give someone source code of something I made because they're having a hissy fit over security.

You don't trust it? Don't use it.


So trying to help new users or protect users that may not be super into tech is now shown as being a "dick" and FUD. Yeah I guess I just shouldn't help those people anymore.

The only remotely bad thing was that he posted the hash of a password, and that password being find-able via Google search.

So yeah, FUD.
legendary
Activity: 1134
Merit: 1118
So now we have FUD from both TF and gweedo.

Oh, for fuck sake, guys. Trying to paint each other red, there is always some kind of drama on this forum. This fucking FUD does not improve your reputation, it just makes you look like a dick.

@gweedo: I would trust TF with my bank account details, I'm 99% sure that he will never scam or access passwords for malicious use. Especially as people do have his personal info. He also DOES hash and salt his passwords, he doesn't need to give you his source code. Hell, I wouldn't give someone source code of something I made because they're having a hissy fit over security.

You don't trust it? Don't use it.
legendary
Activity: 1890
Merit: 1086
Ian Knowles - CIYAM Lead Developer
Thank you by your logic you are "an idiot, no exceptions".

I can't see "davout's" posts as he is the only member of this forum that I have ignored but I think you have quite likely nailed it on the head (especially when you consider what happened to his own website).
donator
Activity: 1218
Merit: 1079
Gerald Davis
Care to clarify?  The purpose of salt is to prevent pre-execution attack (i.e. rainbow tables).
Yes, thing is, that's not really how passwords are cracked nowadays.

Yeah rainbow tables can't be used BECAUSE sites employ the use of strong random salt.  If you passwords aren't salted then you are vulnerable to this much faster form of precomputation attack.

Furthermore many key derivitive functions like bcrypt have integrated support for generating and storing salt.  It no requires no additional work.
Yup, and that's precisely why the "should we use salts" question is completely outdated, you don't hash, use salts or whatever, you do the right thing, you use bcrypt.

Um bcrypt is a salted hash.  Are you dense?


If you're still using salts in 2013 you're an idiot, no exceptions.

We actually switched to bcrypt before you even registered on bitcointalk.

Thank you by your logic you are "an idiot, no exceptions".
legendary
Activity: 1372
Merit: 1008
1davout
Also, the only other person who ignored a vuln disclosure by me since I've came here in 2010 was davout, that worked out well for him didn't it, look at davout for the future of TradeFortress co.

Lolwut?
newbie
Activity: 42
Merit: 0
Also, the only other person who ignored a vuln disclosure by me since I've came here in 2010 was davout, that worked out well for him didn't it, look at davout for the future of TradeFortress co.
newbie
Activity: 42
Merit: 0
Quote
Dude all you do is screw over your users and abuse your powers

Yes, I screwed over a hacker / phisher / script kiddie / DoSer. Was he your friend?

Also, you're. Try digesting messages before rushing to post!

I'm happy to post a SQL dump of users.password, which are hashed and salted with a user unique salt. That proves nothing through, if it was not indistinguishable from randomness then it was done wrong.

No, you're not getting SSH / mysql / whatever access.

Friends with Gweedo? grasping at straws there lol! nah bro I don't even know him in fact I'm not sure if he is even a he, I always thought it was a she for some reason, now I'm confused.

EDIT: for clarification, gweedo lent an alt of mine money on btcjam before and I paid him back, thats the only other contact I've ever had with him, try and find out who it was gweedo!

DoSer? your the one who threatened to DoS me lol! provide proof I DoSed anyone, I don't have a botnet.

You've locked down your sites really good on the SQL injection side of things props for that, the rest however if laughably insecure, you clearly nothing about server administration/security but know a bit about web development is all. You remind me of a guy I met recently, he was an NVC developer and earned $200k working for a multi-national, he didn't know what a password hash was, he found the whole thing extremely alien when I explained it to him, he didn't know what ssh was, plus a lot of other things, and he was a web developer earning serious bucks with a very important job with years and years of experience, your just like him, your not capable of running a site on your own you should be a development contractor, and clearly you have no partners either because I don't believe anyone would let you do crazy shit like this.

I have no idea what is wrong with you, maybe its an ego thing, but people need to read this thread and see what you are really like.

Also you should provide that SQL dump, you'll know if its secure if your users don't get hacked after you post it (providing you actually post the real thing and not fake it which you likely will).

You fix that coinchat bug I told you about yet? how about the coinchat vulnerability I told you about or the coinlenders one? and the inputs.io bug/screw up (deposit I made never credited)? I still don't see it in my balance. Theymos was nice enough to listen to me and fix the 'issue' I pointed out to him on bitcointalk and even followed through and paid me the bounty, you just said 'oh your a phisher fuck off' didn't pay me for any of the ones I pointed out to you and didn't even fix them in some cases, so there will be no more dislosures when I find bugs/vulns in your sites, I will use them for personal gain.

Go and check your logs on coinchat for the "hollowinfinity" episode, where that account was hacked multiple times, you'll noticed I used a fuckload of vulnerabilities on your site that day, I'm never going to disclose them to you and your to incompetent to find them. And post the chatlog here from that 'episode' too so people can see how secure your shit really is.
vip
Activity: 1316
Merit: 1043
👻
Quote
Dude all you do is screw over your users and abuse your powers

Yes, I screwed over a hacker / phisher / script kiddie / DoSer. Was he your friend?

Also, you're. Try digesting messages before rushing to post!

I'm happy to post a SQL dump of users.password, which are hashed and salted with a user unique salt. That proves nothing through, if it was not indistinguishable from randomness then it was done wrong.

No, you're not getting SSH / mysql / whatever access.

ooooh, in your quoted excerpt he actually used the possessive pronoun "your" correctly. a bit quick to flame back, eh Señor Grammar Nazi?  Cheesy

Lol, my mistake, sorry Cheesy

Anyway, gweedo, I'm happy to remove my negative feedback if you stop continue to make misleading and factually incorrect statements regarding my websites. You don't need to remove anything, that's extortion. I made it clear my negative feedback was because you continued to lie and spread FUD.
legendary
Activity: 1834
Merit: 1019
Quote
Dude all you do is screw over your users and abuse your powers

Yes, I screwed over a hacker / phisher / script kiddie / DoSer. Was he your friend?

Also, you're. Try digesting messages before rushing to post!

I'm happy to post a SQL dump of users.password, which are hashed and salted with a user unique salt. That proves nothing through, if it was not indistinguishable from randomness then it was done wrong.

No, you're not getting SSH / mysql / whatever access.

ooooh, in your quoted excerpt he actually used the possessive pronoun "your" correctly. a bit quick to flame back, eh Señor Grammar Nazi?  Cheesy
vip
Activity: 1316
Merit: 1043
👻
Quote
Dude all you do is screw over your users and abuse your powers

Yes, I screwed over a hacker / phisher / script kiddie / DoSer. Was he your friend?

Also, you're. Try digesting messages before rushing to post!

I'm happy to post a SQL dump of users.password, which are hashed and salted with a user unique salt. That proves nothing through, if it was not indistinguishable from randomness then it was done wrong.

No, you're not getting SSH / mysql / whatever access.
vip
Activity: 1316
Merit: 1043
👻
LOL so gweedo still wants the database of coinlenders. Dream on buddy.
Pages:
Jump to: