Bitcoin Forum
August 29, 2024, 04:04:56 AM
Welcome,
Guest
. Please
login
or
register
.
News
: All versions of Windows are affected by a
critical security bug
; make sure you update.
Home
Help
Search
Login
Register
More
Bitcoin Forum
>
Economy
>
Marketplace
>
Service Discussion
>
Inputs.io Security [Solved]
Pages: [
1
]
« previous topic
next topic »
Print
Author
Topic: Inputs.io Security [Solved] (Read 896 times)
nimda
(OP)
Hero Member
Offline
Activity: 784
Merit: 1000
0xFB0D8D1534241423
Inputs.io Security [Solved]
July 02, 2013, 03:25:30 PM
Last edit: July 05, 2013, 09:03:43 PM by nimda
#1
Quote
Passwords hashed with SHA256 before sent to the server - we never know your password
This concerns me slightly. The whole point of a hash is irreversibility once the server is compromised. However, this just uses the sha2
as the password
. It's therefore a step forwards in some areas and a step backwards in others, unless the server takes the hash of the hash once received.
tom1
Full Member
Offline
Activity: 130
Merit: 100
Re: Inputs.io Security
July 02, 2013, 04:05:11 PM
#2
I'm wondering why there isn't an official thread about Inputs.io?
█ ♦
Coinroll.it - 1% House Edge Dice Game
♦ █
• Coinroll Thread
• *FREE* 100 BTC Raffle
My address for signing messages
escrow.ms
Legendary
Offline
Activity: 1274
Merit: 1004
Re: Inputs.io Security
July 02, 2013, 04:07:10 PM
#3
Quote from: tom1 on July 02, 2013, 04:05:11 PM
I'm wondering why there isn't an official thread about Inputs.io?
Because it's in beta aka testing stage.
tom1
Full Member
Offline
Activity: 130
Merit: 100
Re: Inputs.io Security
July 02, 2013, 04:29:01 PM
#4
Quote from: escrow.ms on July 02, 2013, 04:07:10 PM
Quote from: tom1 on July 02, 2013, 04:05:11 PM
I'm wondering why there isn't an official thread about Inputs.io?
Because it's in beta aka testing stage.
Hmm, it looks like it was released today:
https://inputs.io/news#n-2
█ ♦
Coinroll.it - 1% House Edge Dice Game
♦ █
• Coinroll Thread
• *FREE* 100 BTC Raffle
My address for signing messages
paroxsitic
Newbie
Offline
Activity: 37
Merit: 0
Re: Inputs.io Security
July 04, 2013, 03:33:08 PM
#5
I have confirmed via HTTP recording they do send just a SHA256 hashed password over the network (with no salt). It would indeed be more secure to salt your pin code you entered in a way that would not be obvious to someone who was sniffing around.
None the less, hashing a password before it's sent in a POST is more secure most non-financial sites.
I can only hope they do some sort of unique salt when storing the password to their database.
MPOE-PR
Hero Member
Offline
Activity: 756
Merit: 522
Re: Inputs.io Security
July 04, 2013, 11:41:14 PM
#6
Quote from: nimda on July 02, 2013, 03:25:30 PM
Quote
Passwords hashed with SHA256 before sent to the server - we never know your password
This concerns me slightly. The whole point of a hash is irreversibility once the server is compromised. However, this just uses the sha2
as the password
. It's therefore a step forwards in some areas and a step backwards in others, unless the server takes the hash of the hash once received.
There's no real reason to suspect they aren't taking the hash of the hash is there?
My Credentials
|
THE
BTC Stock Exchange
| I have my very own
anthology
! | Use
bitcointa.lk
, it's like this one but better.
🏰 TradeFortress 🏰
Bitcoin Veteran
VIP
Legendary
Offline
Activity: 1316
Merit: 1043
👻
⇾
Re: Inputs.io Security
July 04, 2013, 11:57:20 PM
Last edit: July 05, 2013, 12:11:52 AM by TradeFortress
#7
Quote from: MPOE-PR on July 04, 2013, 11:41:14 PM
Quote from: nimda on July 02, 2013, 03:25:30 PM
Quote
Passwords hashed with SHA256 before sent to the server - we never know your password
This concerns me slightly. The whole point of a hash is irreversibility once the server is compromised. However, this just uses the sha2
as the password
. It's therefore a step forwards in some areas and a step backwards in others, unless the server takes the hash of the hash once received.
There's no real reason to suspect they aren't taking the hash of the hash is there?
This.
We use bcrypt on the server side, with a user unique salt.
nimda
(OP)
Hero Member
Offline
Activity: 784
Merit: 1000
0xFB0D8D1534241423
Re: Inputs.io Security
July 05, 2013, 09:03:19 PM
#8
Quote from: MPOE-PR on July 04, 2013, 11:41:14 PM
Quote from: nimda on July 02, 2013, 03:25:30 PM
Quote
Passwords hashed with SHA256 before sent to the server - we never know your password
This concerns me slightly. The whole point of a hash is irreversibility once the server is compromised. However, this just uses the sha2
as the password
. It's therefore a step forwards in some areas and a step backwards in others,
unless the server takes the hash of the hash once received
.
There's no real reason to suspect they aren't taking the hash of the hash is there?
The phrasing of the FAQ had me worried.
Quote from: TradeFortress on July 04, 2013, 11:57:20 PM
We use bcrypt on the server side, with a user unique salt.
That's good, thanks. I'll lock the topic.
Pages: [
1
]
Print
Bitcoin Forum
>
Economy
>
Marketplace
>
Service Discussion
>
Inputs.io Security [Solved]
« previous topic
next topic »
Jump to:
Please select a destination:
-----------------------------
Bitcoin
-----------------------------
=> Bitcoin Discussion
===> Legal
===> Press
===> Meetups
===> Important Announcements
=> Development & Technical Discussion
===> Wallet software
=====> Electrum
=====> Bitcoin Wallet for Android
=====> BitcoinJ
=====> Armory
=====> Mycelium
=====> Hardware wallets
=> Mining
===> Mining support
===> Pools
===> Mining software (miners)
===> Hardware
=====> Group buys
===> Mining speculation
=> Bitcoin Technical Support
=> Project Development
-----------------------------
Economy
-----------------------------
=> Economics
===> Speculation
=> Marketplace
===> Goods
=====> Computer hardware
=====> Digital goods
=======> Invites & Accounts
=====> Collectibles
===> Services
===> Currency exchange
===> Gambling
=====> Games and rounds
=====> Investor-based games
=====> Gambling discussion
===> Lending
=====> Long-term offers
===> Securities
===> Auctions
===> Service Announcements
=====> Micro Earnings
===> Service Discussion
=====> Web Wallets
=====> Exchanges
=> Trading Discussion
===> Scam Accusations
===> Reputation
-----------------------------
Other
-----------------------------
=> Meta
===> New forum software
===> Bitcoin Wiki
=> Politics & Society
=> Beginners & Help
=> Off-topic
=> Serious discussion
===> Ivory Tower
=> Archival
===> Корзина
===> CPU/GPU Bitcoin mining hardware
===> Chinese students
===> Obsolete (buying)
===> Obsolete (selling)
===> MultiBit
-----------------------------
Alternate cryptocurrencies
-----------------------------
=> Altcoin Discussion
=> Announcements (Altcoins)
===> Tokens (Altcoins)
=> Mining (Altcoins)
===> Pools (Altcoins)
=> Marketplace (Altcoins)
===> Service Announcements (Altcoins)
===> Service Discussion (Altcoins)
===> Bounties (Altcoins)
=> Speculation (Altcoins)
-----------------------------
Local
-----------------------------
=> العربية (Arabic)
===> العملات البديلة (Altcoins)
=====> النقاشات
===> إستفسارات و أسئلة المبتدئين
===> التعدين
===> النقاشات الأخرى
===> منصات التبادل
=> Bahasa Indonesia (Indonesian)
===> Marketplace (Bahasa Indonesia)
===> Mining (Bahasa Indonesia)
===> Altcoins (Bahasa Indonesia)
===> Trading dan Spekulasi
===> Ekonomi, Politik, dan Budaya
===> Topik Lainnya
=> Español (Spanish)
===> Mercado y Economía
=====> Servicios
=====> Trading y especulación
===> Hardware y Minería
===> Esquina Libre
===> Mercadillo
=====> Mexico
=====> Argentina
=====> España
=====> Centroamerica y Caribe
===> Primeros pasos y ayuda
===> Altcoins (criptomonedas alternativas)
=====> Minería de altcoins
=====> Servicios
=====> Tokens (Español)
=> 中文 (Chinese)
===> 跳蚤市场
===> 山寨币
===> 媒体
===> 挖矿
===> 离题万里
=> Hrvatski (Croatian)
===> Trgovina
===> Altcoins (Hrvatski)
=====> Announcements (Hrvatski)
===> Off-topic (Hrvatski)
=> Deutsch (German)
===> Anfänger und Hilfe
===> Mining (Deutsch)
===> Trading und Spekulation
===> Projektentwicklung
===> Off-Topic (Deutsch)
===> Treffen
===> Presse
===> Altcoins (Deutsch)
=====> Announcements (Deutsch)
===> Marktplatz
=====> Auktionen
=====> Suche
=====> Biete
=> Ελληνικά (Greek)
===> Αγορά
===> Mining Discussion (Ελληνικά)
===> Altcoins (Ελληνικά)
=====> Altcoin Announcements (Ελληνικά)
=====> Altcoin Mining (Ελληνικά)
=> עברית (Hebrew)
=> Français
===> Actualité et News
===> Débutants
===> Discussions générales et utilisation du Bitcoin
===> Mining et Hardware
===> Économie et spéculation
===> Place de marché
=====> Échanges
=====> Produits et services
=====> Petites annonces
===> Le Bitcoin et la loi
===> Wiki, documentation et traduction
===> Développement et technique
===> Vos sites et projets
===> Hors-sujet
===> Altcoins (Français)
=====> Annonces
=> India
===> Mining (India)
===> Marketplace (India)
===> Regional Languages (India)
===> Press & News from India
===> Alt Coins (India)
===> Buyer/ Seller Reputations (India)
===> Off-Topic (India)
=> Italiano (Italian)
===> Guide (Italiano)
===> Progetti
===> Discussioni avanzate e sviluppo
===> Trading, analisi e speculazione
===> Mercato
=====> Mercato valute
=====> Beni
=====> Servizi
=====> Esercizi commerciali
=====> Hardware/Mining (Italiano)
=====> Gambling (Italiano)
===> Accuse scam/truffe
===> Mining (Italiano)
===> Alt-Currencies (Italiano)
=====> Annunci
===> Raduni/Meeting (Italiano)
===> Crittografia e decentralizzazione
===> Off-Topic (Italiano)
=> 日本語 (Japanese)
===> アルトコイン
=> Nederlands (Dutch)
===> Markt
===> Gokken/lotterijen
===> Mining (Nederlands)
===> Beurzen
===> Alt Coins (Nederlands)
===> Off-topic (Nederlands)
===> Meetings (Nederlands)
=> Nigeria (Naija)
===> Politics and society (Naija)
===> Off-topic (Naija)
=> 한국어 (Korean)
===> 대체코인 Alt Coins (한국어)
=> Pilipinas
===> Altcoins (Pilipinas)
=====> Altcoin Announcements (Pilipinas)
===> Pamilihan
===> Others (Pilipinas)
=> Polski
===> Tablica ogłoszeń
===> Alternatywne kryptowaluty
=====> Nowe kryptowaluty i tokeny
=====> Tablica ogłoszeń (altcoiny)
=> Português (Portuguese)
===> Primeiros Passos (Iniciantes)
===> Economia & Mercado
===> Mineração em Geral
===> Desenvolvimento & Discussões Técnicas
===> Criptomoedas Alternativas
===> Brasil
===> Portugal
=> Русский (Russian)
===> Новички
===> Бизнес
=====> Барахолка
=====> Обменники
===> Идеи
===> Кодеры
===> Майнеры
===> Политика
===> Трейдеры
===> Альтернативные криптовалюты
=====> Токены
=====> Бayнти и aиpдpoпы
===> Хайпы
===> Работа
===> Разное
===> Oбcyждeниe Bitcoin
=====> Новости
=====> Юристы
=> Română (Romanian)
===> Anunturi importante
===> Offtopic
===> Market
=====> Discutii Servicii
===> Minerit
===> Tutoriale
===> Bine ai venit!
===> Presa
===> Altcoins (Monede Alternative)
=====> Anunturi Monede Alternative
=> Skandinavisk
=> Türkçe (Turkish)
===> Bitcoin Haberleri
===> Pazar Alanı
===> Madencilik
===> Ekonomi
===> Servisler
=====> Fonlar
===> Proje Geliştirme
===> Alternatif Kripto-Paralar
=====> Madencilik (Alternatif Kripto-Paralar)
=====> Duyurular (Alternatif Kripto-Paralar)
===> Konu Dışı
===> Yeni Başlayanlar & Yardım
===> Buluşmalar
=> Other languages/locations
Loading...