Hacker News new | past | comments | ask | show | jobs | submit login

It's not clear how datetime was used and why that became a weakness? Doesn't it improve the password security by taking some bytes from /dev/random and salting it with <timestamp>?



The roboform password manager used datetime value as the seed of the pseudorandom generator, meaning that it would always generate the same password if the system clock time was the same. They managed to crack the wallet by reverse engineering the password manager and feeding its pseudonumber generator all datetime values between certain dates that were thought to be near the time when the original wallet owner had generated the password.


yes so knowing the datetime that was used to salt reduces the search space.


Salt is not the same as seed.


you're right. too late to edit now though




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: