Evernote criticized for substandard security
You've probably heard about how hackers recently broke into Evernote and stole email addresses and usernames, and salted and hashed passwords belonging to its customers. As a result, the company was forced to reset some 50 million passwords belonging to its users, which resulted in the online note-taking service gaining front-page coverage around the world.
As security experts examine Evernote's security implementation, it emerged that the company did not do enough to protect users' security. Specifically, Evernote apparently made use of the MD5 cryptographic algorithm to generate the one-way hashes that were stored in the stolen password database. The problem: MD5 has long been considered to be a poor choice for this purpose.
Indeed, we reported last year of how the programmer who implemented a popular MD5 function has stepped forward to "implore" developers to "migrate to a stronger password scrambler without undue delay." At the heart of the problem is how modern hardware is capable of performing brute force attacks on MD5, working through billions of guesses per second even on lower-end machines. Dedicated rigs built using off-the-shelf hardware can work even faster, scaling up to 50 billion attempts per second with a quartet of GPUs.
Apparently, the use of a random salt has a negligible effect when faced with such rapid password crunching. "When you can do five billion [guesses] per second on one GPU, the salting doesn't make that much of a difference," noted security consultant and software developer Adam Caudill to Ars Technica.
Ultimately, it may be the case of developers simply not being trained in cryptographic matters. Security researcher Thomas H. Ptacek from Matasano Security probably says it best when he was quoted last year as saying: "I think it's a problem of generalist developers writing password storage systems. They may be good developers, but they're almost never security domain specialists."
- check out this article at InformationWeek