Subject: Confirm Report Results- [No. 25-842525]

From: Online Background Check <[email-masked]>
Date: Wed, 18 Jun 2014 07:52:49 -0700

Public, Civil & Criminal Records 
Arrest Reports >> Criminal Records 
:: Results Posted - last updated 06/18/2014
==============================================

>> Records Compiled from local, state and federal records <<

1) Enter Name Here -> http://www.tagsobit.com/database/updated/june18.index
2) Gain Full Access to Records. 

** Previous Addresses | Phone Numbers | Social Media Accounts | Emails

We hope that you found this report useful. 
To stop further reports - write Current Update Alerts
1644 Doral Drive_B r o o k i n g s, SD 57006 or go to http://www.tagsobit.com/o4jgt/dfmngo4.dfkgr

Frank, while what you say is true, the algorithmic cycles it takes to generate the words doesn't make it feasible. Don't forget the inclusion of the salt. Brute force will always work if they know your hash algorithm and salt, otherwise it's virtually impossible.   Robert K Dec 31 '08 at 13:52
  	  	
But that doesn't make insecure passwords any safer. It just makes the database rows safer if compromised, at which point you should change your salt immediately and inform your users to change their passwords.   Robert K Even when the salt and algorithm are known, finding a password by brute-force search will take many years if the proper method is used. Passwords are cracked when they are predicted by following a pattern, such as transforming dictionary words and incorporating other cribs. An essential part of the method is some sort of computationally intensive key stretching technique, like using thousands of iterations of the hash function.    	
for the accepted answer, there is a lot of advice that is in contradiction to most of the arguments on posts like: I'm not slamming the wicked flea - just expressing a growing "hair-pulling" feeling regarding trying make sense of this. crypto-security seems a lot like a poetry slam. everyone has their own beat and groove.   m42 , if I were designing a truly secure system, I'd suggest a military grade hash algorithm anyway with a ~16bit randomly generated number stored in the database. In general use, a salt with a password is better than none--unless either is compromised. I'm not claiming to be an expert, nothing is better than enforced password rotation plus a military-grade algorithm, but for basic non-critical software this is enough.   Robert K May 26 '09 at 0:11
4	  	
@wicked flea, I'm not arguing with you. Just pointing out how convoluted and complex this area of our work is. I keep hoping to get schooled by the be-all, end-all smartest, best practice for setting up a small web site's content management system. I'm still learning here. ...every time I read something that makes sense, I soon notice 5 other posts that contradict it. that round-and-round gets dizzying quickly :)   m42 May 26 '09 at 0:16
  	  	
Absolutely! I've just shared what I've found. I found a number of things from Shneier on Security and a very long (convoluted) discussion on a news site (don't remember which now).   Robert K May 26 '09 at 0:28
2	  	
"Even MD5 is still safe, as aside from a brute-force attack the computational power needed to decrypt doesn't exist yet." OMG, I don't believe it. MD5 can't be "decrypted", period. But it is definitly not safe, as it is. Ever heard of rainbow tables?   Lohoris May 5 '10 at 10:16
2	  	
Look, if you're using MD5 on software that requires high security (like a store) then YOU'RE the fool, not me. I know that MD5 is extremely fast, but if you're designing forum software with good practices it's still generally secure.   Robert K May 20 '10 at 14:14
4	  	
Interesting revision. Is the user ID(say, an auto increment BIGINT) a good nonce? Or since it's not random it isn't good? Also, I'll have to store the nonce for each user in the database... Does the site key + nonce + HMAC provide significant improved security over a salted(with user ID) hash iterated multiple times? Similarly, is iterating HMAC multiple times good for security?   luiscubal Jul 7 '10 at 20:07
  	  	
Excellent post. Answered many of my own questions. However, I am uncertain of what it means to save the site_key in the file system. Could you please explain? For me, even a .php file in a folder on the server is the file system.   Francisc Apr 5 '11 at 14:08