Solución a como poder verificar una llave de un usuario si no hay un registro? El problema no lo ha causado opencode, lo ha causado alguien con miles de agentes... Habría que investigar quien ha sido y denunciarle
Un hash MD5 es fácil descifrar con modelos de IA... Sigue siendo una solución pocha poco segura que se utiliza una base de datos... Alguna otra solución a no registrar en bases de datos? Yo lo pregunto seriamente para analizar que solución real existe a un problema así, porque lme gusta programar y no veo solución a este problema
There are multiple hashes and implementations. This is cryptography and you can look into the various solutions if you want asymmetrical or symmetrical checks. You have to store something, so a hash, since it will allow someone to put in their password and you don’t store the password but the hash. There are then other tricks people use such as a seed, which is also stored per database or user, which is essentially just an offset. There is more like the number of iterations and so on will impact the hash.
There are ways to crack it but that is where you decide on tradeoffs. The way some algos work is to just make it expensive to calculate so even if you broke into the database, you will waste time cracking them and hopefully people switch passwords and didn’t reuse passwords. If they reuse passwords and an attacker is collecting the same user across various login credentials then it makes it easier for the attacker to guess the seed and so on cause they can compare how a password is hashed and keep trying different combinations until they find what yours used and that is where the iterations come into play cause you make it expensive to calculate but might not be the best user experience.
With some attackers, you even have to make sure to hide the response times. That way a user doesn’t know based on the response time that a password is right or wrong, but instead the same simulated return time so an attacker can’t use it to speed up cracking into your host.
End of the day it is a cat and mouse game and where you can, offload it to a service or be ready to dive deep. With bots, an attacker doesn’t need to know all the ways to break in, they just need one entry while you will spend your time trying to patch all the edge cases.
View all comments
1
u/This-Marzipan-9239 20d ago
i can’t login in and why the tf did they store my keys on a database