| 01:06.09 | *** join/#uphpu john_anderson (~textual@192.150.9.200) |
| 01:07.55 | *** join/#uphpu lukeholder (~textual@116.212.205.122) |
| 01:31.46 | *** join/#uphpu josephscott (~josephsco@208.95.156.134) |
| 01:38.31 | josephscott | $rlart |
| 01:38.31 | raifbot | pushes the wall down onto romanovic whilst whistling innocently. |
| 02:12.02 | *** join/#uphpu lukeholder (~textual@116.212.205.122) |
| 02:14.22 | *** join/#uphpu mgeary (~mgeary@69.169.142.45.provo.static.broadweavenetworks.net) |
| 02:14.23 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 02:43.56 | *** join/#uphpu john_anderson (~textual@192.150.9.200) |
| 03:22.38 | *** join/#uphpu T4rku5 (~74rku5@unaffiliated/shunkydave) |
| 04:30.40 | *** join/#uphpu josephscott (~josephsco@104.2.233.72.static.reverse.ltdomains.com) |
| 11:50.42 | *** join/#uphpu itimber (~Adium@204.10.232.242) |
| 11:51.14 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 13:04.52 | *** join/#uphpu supernovia (~Adium@208.64.91.46.static.utbb.net) |
| 13:04.52 | *** mode/#UPHPU [+v supernovia] by ChanServ |
| 13:50.04 | *** join/#uphpu mgeary (~mgeary@69.169.142.45.provo.static.broadweavenetworks.net) |
| 13:50.05 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 13:53.01 | *** join/#uphpu mgeary (~mgeary@69.169.142.45.provo.static.broadweavenetworks.net) |
| 13:53.01 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 14:07.54 | *** join/#uphpu opapo (~quassel@204.113.97.235) |
| 14:07.54 | *** mode/#UPHPU [+v opapo] by ChanServ |
| 14:22.04 | *** join/#uphpu kendsnyder (~kendsnyde@207-224-200-203.slkc.qwest.net) |
| 14:22.04 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 14:26.36 | *** join/#uphpu MikeHansenMe (~mike@RVTNUTMADS0CU02.mcleodusa.net) |
| 14:41.17 | *** join/#uphpu eggyknap (~jtolley@184-11-47-142.dr01.dlta.ut.frontiernet.net) |
| 14:41.18 | *** join/#uphpu eggyknap (~jtolley@unaffiliated/eggyknap) |
| 14:41.18 | *** mode/#UPHPU [+v eggyknap] by ChanServ |
| 14:50.35 | *** join/#uphpu mgeary (~mgeary@67.136.112.81) |
| 14:50.36 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 15:01.39 | *** join/#uphpu mahelious (~mahelious@ip65-46-59-10.z59-46-65.customer.algx.net) |
| 15:01.40 | *** mode/#UPHPU [+v mahelious] by ChanServ |
| 15:04.48 | *** join/#uphpu clondon (~clondon@66.219.207.210.provo.dynamic.broadweavenetworks.net) |
| 15:05.17 | clondon | #join |
| 15:09.17 | *** join/#uphpu TuxToaster (~TuxToaste@wfw.vivint.com) |
| 15:09.17 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 15:24.50 | *** join/#uphpu kendsnyder (~kendsnyde@207-224-200-203.slkc.qwest.net) |
| 15:24.50 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 15:25.46 | *** join/#uphpu josephscott (~josephsco@104.2.233.72.static.reverse.ltdomains.com) |
| 15:28.37 | *** join/#uphpu josephscott_ (~josephsco@104.2.233.72.static.reverse.ltdomains.com) |
| 15:29.01 | *** join/#uphpu clintberry (~clintberr@75-148-102-17-Utah.hfc.comcastbusiness.net) |
| 15:29.01 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 15:44.44 | *** join/#uphpu cro (~Adium@204-228-149-217.ip.xmission.com) |
| 15:50.25 | *** part/#uphpu cro (~Adium@204-228-149-217.ip.xmission.com) |
| 15:53.38 | *** join/#uphpu macnewbold (~macnewbol@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 15:53.39 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 15:58.37 | *** join/#uphpu josephscott (~josephsco@208.95.156.134) |
| 16:08.14 | *** join/#uphpu captbrogers (~captbroge@66.7.121.170) |
| 16:08.34 | captbrogers | Anyone knowledgeable in hashing practices for storing passwords? |
| 16:09.27 | *** join/#uphpu undertakingyou (~undertaki@danix.eaerich.com) |
| 16:09.27 | *** mode/#UPHPU [+v undertakingyou] by ChanServ |
| 16:09.28 | josephscott | captbrogers: this for PHP? |
| 16:09.32 | captbrogers | Of course |
| 16:09.41 | josephscott | then use http://www.openwall.com/phpass/ |
| 16:10.03 | captbrogers | All in the context of PHP and PDO to connect to a MySQL server |
| 16:10.48 | captbrogers | Interesting, thanks |
| 16:10.49 | jsmith | captbrogers: Sorry, I'm not understanding. Are you talking about the password to connect to MySQL, or storing account passwords in MySQL itself? |
| 16:11.08 | captbrogers | jsmith: Storing passwords in a database |
| 16:11.21 | jsmith | OK |
| 16:11.33 | josephscott | use phpass |
| 16:11.50 | captbrogers | My sister-in-law is really gaining momentum in learning PHP, so I'm just trying to filter through all the tutorials and wikis to give her some great and easy tutorials |
| 16:11.53 | josephscott | just make sure you aren't allowed for passwords longer than 72 characters |
| 16:12.20 | captbrogers | I already told her to use bcrypt/blowfish |
| 16:12.30 | captbrogers | SHA512 barring bcrypt not available |
| 16:14.33 | *** join/#uphpu macnewbold (~macnewbol@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 16:14.33 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 16:18.05 | josephscott | bcrypt all the way |
| 16:18.14 | josephscott | just don't allow for passwords longer than 72 characters |
| 16:18.35 | *** join/#uphpu UtahDave (~boucha@63.230.12.160) |
| 16:18.36 | *** mode/#UPHPU [+o UtahDave] by ChanServ |
| 16:18.49 | josephscott | phpass takes care of the bcrypt level stuff for you |
| 16:19.31 | *** join/#uphpu john_anderson (~john_ande@192.150.9.200) |
| 16:19.31 | *** mode/#UPHPU [+v john_anderson] by ChanServ |
| 16:19.55 | *** join/#uphpu john_anderson (~john_ande@192.150.9.200) |
| 16:19.56 | *** mode/#UPHPU [+v john_anderson] by ChanServ |
| 16:22.10 | captbrogers | Alright, I'll show it to her |
| 16:22.24 | *** part/#uphpu captbrogers (~captbroge@66.7.121.170) |
| 16:24.03 | *** join/#uphpu DC1 (~DC@neutroninteractive-xmission.xmission.com) |
| 16:29.05 | *** join/#uphpu cro (~Adium@204-228-149-217.ip.xmission.com) |
| 16:45.41 | *** join/#uphpu macnewbold (~macnewbol@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 16:45.42 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 16:47.28 | *** part/#uphpu cro (~Adium@204-228-149-217.ip.xmission.com) |
| 16:51.29 | unum | I use postgres so I just the crypto stuff that comes with it to hash the passwords |
| 16:53.31 | josephscott | unum: does it use bcrypt by default? |
| 16:53.42 | josephscott | been awhile since I've looked the built in postgresql functions |
| 16:56.37 | *** join/#uphpu T4rku5 (~74rku5@unaffiliated/shunkydave) |
| 16:57.59 | unum | I don't think it has a default |
| 16:58.14 | unum | you have to tell it which algorithm to use |
| 17:03.59 | josephscott | I think I'd still prefer hashing on the web server instead |
| 17:04.22 | josephscott | you want password hashes to be slow, easier to distribute that load over multiple web servers than DBs |
| 17:04.42 | fungus | PBKDF2 is a method better tested (so far), NIST standard, and uses params to increase strength on the fly if desired. |
| 17:05.40 | unum | I actually have people authenticating from cli perl apps.... |
| 17:06.14 | josephscott | PBKDF2 doesn't seem to be as widely supported though |
| 17:10.12 | josephscott | I think for now bcrypt has the best combination of broad support, wide use, and strength |
| 17:11.26 | *** join/#uphpu TuxToaster (~TuxToaste@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 17:11.26 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 17:11.49 | fungus | You can use PBKDF2 anywhere. There are code examples in every language. |
| 17:13.05 | fungus | http://en.wikipedia.org/wiki/PBKDF2#Implementations |
| 17:13.26 | fungus | Also, PHP 5.5 will have it built-in |
| 17:13.38 | fungus | http://php.net/manual/en/function.hash-pbkdf2.php |
| 17:14.55 | *** join/#uphpu T4rku5_ (~74rku5@64.78.193.228) |
| 17:14.56 | josephscott | if they have the mhash extension installed |
| 17:16.37 | fungus | The Hash extension requires no external libraries and is enabled by default as of PHP 5.1.2 |
| 17:17.53 | fungus | it's not in mhash. it's part of the Hash extension. Built-in |
| 17:17.57 | josephscott | ah, right |
| 17:19.09 | josephscott | http://en.wikipedia.org/wiki/PBKDF2#Alternatives_to_PBKDF2 |
| 17:19.20 | josephscott | looks like PBKDF2 vs. bcrypt isn't completely cut and dry |
| 17:19.22 | fungus | Yup, very important to consider though. |
| 17:19.48 | josephscott | I keep meaning to spend some time with scrypt, just never get around to it |
| 17:20.05 | josephscott | I do like the bcrypt is super widely used |
| 17:21.30 | fungus | bcrypt is good too, but I like the standardized, widely scrutinized/tested aspects of PBKDF2. Makes me feel warm and fuzzy |
| 17:22.01 | mindjuju | i think a good sign that a fungus is thriving is its fuzziness |
| 17:22.16 | fungus | hehe. |
| 17:24.27 | josephscott | does PBKDF2 have a maximum length? |
| 17:25.16 | josephscott | the scrypt paper also has some good analysis - http://www.tarsnap.com/scrypt/scrypt.pdf |
| 17:25.20 | fungus | not sure, haven't read anything saying it does |
| 17:25.23 | josephscott | though some of it is out of date |
| 17:25.34 | josephscott | bcrypt users up to 72 characters now, not 55 |
| 17:26.09 | josephscott | page 14 on the PDF is worth noting |
| 17:26.31 | josephscott | for shorter (less than 50 characters?) passwords bcrypt appears to do better than PBKDF2 |
| 17:28.35 | mgeary | ninnypants: hey |
| 18:00.19 | ninnypants | $rlart |
| 18:00.19 | raifbot | brandishes Excalibur! "With this sword, I vanquish thee, mindjuju!" and lops off mindjuju's head. |
| 18:23.00 | mindjuju | thx ninnypants, i wasn't using it any way |
| 18:23.04 | mindjuju | DtD, you around ? |
| 18:23.15 | DexterTheDragon | more or less |
| 18:23.31 | mindjuju | did you see they are playing live sets? http://ultramusicfestival.com/ |
| 18:24.19 | mindjuju | last weekend was awesome :) |
| 18:25.47 | DexterTheDragon | yeah I think I saw you post a link but haven't checked it out yet |
| 18:33.25 | *** join/#uphpu cro (~Adium@mountainviewbc.dsl.xmission.com) |
| 18:53.45 | ninnypants | so mindjuju is corban has become a white hat hacker ;) |
| 19:09.54 | *** join/#uphpu TuxToaster (~TuxToaste@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 19:09.54 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 19:10.10 | TuxToaster | $rlart |
| 19:10.10 | raifbot | beats linagee into protomatter with the andromeda galaxy. |
| 19:31.02 | *** join/#uphpu kendsnyder (~kendsnyde@207-224-200-203.slkc.qwest.net) |
| 19:31.02 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 19:32.08 | *** join/#uphpu josephscott (~josephsco@208.95.156.134) |
| 19:51.59 | ninnypants | supernovia: ping |
| 20:49.38 | undertakingyou | supernovia: ping |
| 20:49.50 | mgeary | supernovia: ping |
| 20:50.29 | undertakingyou | she sure is popular :) |
| 21:04.39 | undertakingyou | Oh, well I guess she didn't want to talk. |
| 21:05.43 | DexterTheDragon | the ping of death |
| 21:09.55 | undertakingyou | DexterTheDragon: that is it. We have committed irc murder of sorts. |