Hacker News Reader

Comment by andrewmcwatters | Hacker News Reader

This is a very bad article even if it’s from someone reputable because they don’t explain why not at each step.

It reads as someone smug just saying, “No, you idiot.” And they literally use “WTF,” as if it’s some statement of authority.

Further, that’s not even the right application of “don’t roll your own crypto,” reducing the credibility of the article.

“Don’t roll your own crypto” comes from people suggesting that you don’t implement your own copy of, say Diffie–Hellman key exchange, not making some calls to a RNG, which is ridiculously far more trivial.

Why always use X? Why never use Y? If you can’t articulate it, you’re not teaching anything.

And this guy supposedly teaches, too. What a shame.

Tell me: if you read this article and took away not to ever use floats in cryptography, can you tell me why? No? Interesting.

View on HN

> This is a very bad article even if it’s from someone reputable because they don’t explain why not at each step.

Based on the context and how it's written, I get the feeling he never intended it to be a full fledged article, just some tweets, then it grew organically from there. This was never an instructional piece of work.

I ended up tracking down the tweet thread and every single subthread I read had nothing meaningful to share. There were no insights to glean.

I get this sense from a lot of people in security: smart enough to follow conventional advice, too uneducated to explain why.

This password manager will almost certainly generate basically anything that will get hashed and salted in the end, so it’s all irrelevant as long as it’s basically not outputting passwords from exposed lists, and even then it’s still mostly irrelevant.

I have never once heard of particular passwords being an issue in the industry outside of social engineering or common password lists. Completely irrelevant. It’s almost always data breaches.

Never does it hit the news that 3.5 million password were cracked due to hackers reverse engineering the time the accounts were created against popular password managers.

What nonsense.

If you simply generated a password from /dev/urandom, it would have almost as much consequence as whatever they’re doing here.

Edit: The source article referenced is the only thing meaningful, which explains the severity, everyone else commenting on it was a dope.

You have completely missed one of the the key points of the thread.

Seeding the random number generator with the current time, measured in seconds, removes any element of randomness from the password generator. It makes it straightforward to produce a list of every password that this software has ever generated, or will generate in the future.

Yeah, you’re right, I did, because the tweets were worse than worthless. Just link to the source article.

This isn't an article. This is a computer-generated roll-up of a series of tweets, hence the brevity.

And the quality, apparently. The source article is worth reading, but none of the tweets are.

Reply on news.ycombinator.com