{"action":"created","issue":{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5","repository_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes","labels_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5/comments","events_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5/events","html_url":"https://github.com/makersphereHQ/emoji-passcodes/issues/5","id":177575738,"number":5,"title":"Use jsSHA with Increased Number of Rounds","user":{"login":"DaKnOb","id":743648,"avatar_url":"https://avatars.githubusercontent.com/u/743648?v=3","gravatar_id":"","url":"https://api.github.com/users/DaKnOb","html_url":"https://github.com/DaKnOb","followers_url":"https://api.github.com/users/DaKnOb/followers","following_url":"https://api.github.com/users/DaKnOb/following{/other_user}","gists_url":"https://api.github.com/users/DaKnOb/gists{/gist_id}","starred_url":"https://api.github.com/users/DaKnOb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DaKnOb/subscriptions","organizations_url":"https://api.github.com/users/DaKnOb/orgs","repos_url":"https://api.github.com/users/DaKnOb/repos","events_url":"https://api.github.com/users/DaKnOb/events{/privacy}","received_events_url":"https://api.github.com/users/DaKnOb/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/labels/impact/crypto","name":"impact/crypto","color":"c2e0c6"},{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/labels/kind/enhancement","name":"kind/enhancement","color":"f9d0c4"},{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/labels/kind/feature","name":"kind/feature","color":"bfdadc"},{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/labels/kind/helpwanted","name":"kind/helpwanted","color":"bfd4f2"},{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/labels/version/2.0.0","name":"version/2.0.0","color":"e6e6e6"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/milestones/1","html_url":"https://github.com/makersphereHQ/emoji-passcodes/milestones/2.0.0","labels_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/milestones/1/labels","id":2011008,"number":1,"title":"2.0.0","description":"","creator":{"login":"makersphereLabs","id":16872288,"avatar_url":"https://avatars.githubusercontent.com/u/16872288?v=3","gravatar_id":"","url":"https://api.github.com/users/makersphereLabs","html_url":"https://github.com/makersphereLabs","followers_url":"https://api.github.com/users/makersphereLabs/followers","following_url":"https://api.github.com/users/makersphereLabs/following{/other_user}","gists_url":"https://api.github.com/users/makersphereLabs/gists{/gist_id}","starred_url":"https://api.github.com/users/makersphereLabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/makersphereLabs/subscriptions","organizations_url":"https://api.github.com/users/makersphereLabs/orgs","repos_url":"https://api.github.com/users/makersphereLabs/repos","events_url":"https://api.github.com/users/makersphereLabs/events{/privacy}","received_events_url":"https://api.github.com/users/makersphereLabs/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":0,"state":"open","created_at":"2016-09-17T14:03:08Z","updated_at":"2016-09-23T15:07:16Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2016-09-17T13:26:10Z","updated_at":"2016-09-23T15:07:53Z","closed_at":null,"body":"When hashing something, for example a password, it is a good practice to hash it more than one time so as to increase the work an attacker has to do assuming they receive the hash. In this program, while you may not be storing these passwords and risking them being leaked, you provide a service similar to the [Bitcoin Brainwallet](https://en.bitcoin.it/wiki/Brainwallet). The most popular solution of this software used a single iteration of SHA-2 to create the wallet's private key. This lead to many people brute forcing all passwords up to a few characters and storing their private keys beforehand, allowing them to steal all the BTC from people using weak passwords.\r\n\r\nA good solution to slow attackers down / prevent them from getting up to large lengths of passwords is to use multiple iterations of the hashing algorithm. For example, if instead of a single SHA-512 that's being used currently, you did 1,000 or 5,000 or 10,000 iterations, it would increase the cost of the attacker 1,000 or 5,000 or 10,000 times respectively. Now keep in mind this also slows down by the same factor all the legitimate users, so you may want to play with this until you arrive at the correct value. The general recommendation is \"As much as you can afford\". \r\n\r\n[jsSHA already has a `numRounds` parameter that you can pass](https://github.com/Caligatio/jsSHA#hashing) to achieve this, however its internal workings are unknown to me, therefore I cannot guarantee its efficiency / security. However, it is a good start that can help you enhance your product's security very quickly."},"comment":{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/comments/249218182","html_url":"https://github.com/makersphereHQ/emoji-passcodes/issues/5#issuecomment-249218182","issue_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5","id":249218182,"user":{"login":"atoponce","id":699572,"avatar_url":"https://avatars.githubusercontent.com/u/699572?v=3","gravatar_id":"","url":"https://api.github.com/users/atoponce","html_url":"https://github.com/atoponce","followers_url":"https://api.github.com/users/atoponce/followers","following_url":"https://api.github.com/users/atoponce/following{/other_user}","gists_url":"https://api.github.com/users/atoponce/gists{/gist_id}","starred_url":"https://api.github.com/users/atoponce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/atoponce/subscriptions","organizations_url":"https://api.github.com/users/atoponce/orgs","repos_url":"https://api.github.com/users/atoponce/repos","events_url":"https://api.github.com/users/atoponce/events{/privacy}","received_events_url":"https://api.github.com/users/atoponce/received_events","type":"User","site_admin":false},"created_at":"2016-09-23T15:07:53Z","updated_at":"2016-09-23T15:07:53Z","body":"@makersphereLabs No problem. The reason scrypt should be used over generic cryptographic hashing functions, is because you don't want a password cracker to quickly guess the base64 password by working through emoji quickly, creating large rainbow tables.\n\nUnfortunately, people will use common emoji sequences for their password generation, such as creating sentences or stories with their emoji. By using a fast cryptographic hashing function, password crackers can build rainbow tables of common sequences quickly. By using a slow dedicated password hashing function, it becomes expensive to create those tables.\n\nBy increasing the emoji length to 7 from 4, it now requires 1791^7 work with a slow function to create the rainbow table instead of 1791^4. The amount of work has increased exponentially."}}
{"actor":{"display_login":"atoponce"}}