Subject: MD5 crypto!

From: <[email-masked]>
Date: Tue, 21 Apr 2015 22:48:56 +0000

Despite the existence of RFC6151...

http://www.loginwall.com/Solutions.php

Lloyd Wood
http://about.me/lloydwood

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 22 Apr 2015 00:33:09 +0000

> http://www.loginwall.com/Solutions.php

Very much not surprising:

    LoginWall passwords (LoginWall on Key, LoginWall between Keys,
    and LoginWall Combo) are the next generation in password
    security. LoginWall technology adds a new, second parameter to
    the conventional character-based password. This dual parameter
    feature produces a hack-proof login password.

    LoginWall uses multiple encryption layers, which include several
    MD5 encryptions for different keys. This and the inclusion of
    one or more time-based parameters make it practically impossible
    to crack a LoginWall password --even for the strongest computer
    in the world.

    Why take any chances, when you can choose LoginWall?

I think MD5 tastes better when taken with a bit of snake-oil.  It
is possible, I guess, that there's a legitimate product hiding
behind a classic snake-oil marketing MO, but I for one would not
bother to check.  The marketing thoroughly discredits the product.

-- 
	Viktor.

---

From: Paul Wouters <[email-masked]>
Date: Tue, 21 Apr 2015 21:02:50 -0400 (EDT)

> http://www.loginwall.com/Solutions.php

6151 only talks about MD5 Message-Digest and the HMAC-MD5.

It does not include "MD5 encryption" :)

Paul

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 22 Apr 2015 11:28:40 -0400

> It does not include "MD5 encryption" :)

For this particular application, MD5 is not the weakest link in the
chain, nor are the weaknesses in MD5 actually relevant.

I would not use MD5 in any application simply because there are
alternatives that don't require detailed explanation of why they are
safe. But I am pretty sure that unless we are talking about machine
generated passwords, an attack on MD5 is going to have a much higher
workfactor than brute forcing the password space.

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 22 Apr 2015 16:32:28 -0500

Agree. Here we always have 2 factors to consider: how safe it is and how long it takes to break. If time and cost to break are higher that the good we are trying to protect, we can use what we have. 

Carlos Vera
Internet Society Ecuador
www.isoc.org.ec
Síguenos @isocec

> El 22/4/2015, a las 10:28, Phillip Hallam-Baker <[email-masked]> escribió:
>