What does “in-house hash function” mean?











up vote
27
down vote

favorite
1












In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete paper introducing the vulnerability here.



But I do not understand if the term of "in-house" represents a specific type of hash function? And in general, what does "in-house" mean here?










share|improve this question




















  • 58




    I believe the definition of "In-house hash function" is "Don't use our product, we have no idea what we're doing". (see Steffen's answer for a less cheeky response)
    – Mike Ounsworth
    yesterday






  • 27




    It means the same thing that "homeowner wiring" means to electricians.
    – Eric Lippert
    yesterday






  • 8




    @EricLippert Be fair. There's less of a chance of a catastrophic fire and loss of life with homeowner wiring.
    – Nic Hartley
    yesterday






  • 1




    “in-house” is a term which, if heard several times at an interview causes one to lose desire to be offered the job. Generally speaking, “in-house” can be seen as the polar opposite of “industry standard”.
    – Mawg
    18 hours ago















up vote
27
down vote

favorite
1












In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete paper introducing the vulnerability here.



But I do not understand if the term of "in-house" represents a specific type of hash function? And in general, what does "in-house" mean here?










share|improve this question




















  • 58




    I believe the definition of "In-house hash function" is "Don't use our product, we have no idea what we're doing". (see Steffen's answer for a less cheeky response)
    – Mike Ounsworth
    yesterday






  • 27




    It means the same thing that "homeowner wiring" means to electricians.
    – Eric Lippert
    yesterday






  • 8




    @EricLippert Be fair. There's less of a chance of a catastrophic fire and loss of life with homeowner wiring.
    – Nic Hartley
    yesterday






  • 1




    “in-house” is a term which, if heard several times at an interview causes one to lose desire to be offered the job. Generally speaking, “in-house” can be seen as the polar opposite of “industry standard”.
    – Mawg
    18 hours ago













up vote
27
down vote

favorite
1









up vote
27
down vote

favorite
1






1





In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete paper introducing the vulnerability here.



But I do not understand if the term of "in-house" represents a specific type of hash function? And in general, what does "in-house" mean here?










share|improve this question















In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete paper introducing the vulnerability here.



But I do not understand if the term of "in-house" represents a specific type of hash function? And in general, what does "in-house" mean here?







hash terminology






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited yesterday









Anders

48.4k22136157




48.4k22136157










asked yesterday









sas

479148




479148








  • 58




    I believe the definition of "In-house hash function" is "Don't use our product, we have no idea what we're doing". (see Steffen's answer for a less cheeky response)
    – Mike Ounsworth
    yesterday






  • 27




    It means the same thing that "homeowner wiring" means to electricians.
    – Eric Lippert
    yesterday






  • 8




    @EricLippert Be fair. There's less of a chance of a catastrophic fire and loss of life with homeowner wiring.
    – Nic Hartley
    yesterday






  • 1




    “in-house” is a term which, if heard several times at an interview causes one to lose desire to be offered the job. Generally speaking, “in-house” can be seen as the polar opposite of “industry standard”.
    – Mawg
    18 hours ago














  • 58




    I believe the definition of "In-house hash function" is "Don't use our product, we have no idea what we're doing". (see Steffen's answer for a less cheeky response)
    – Mike Ounsworth
    yesterday






  • 27




    It means the same thing that "homeowner wiring" means to electricians.
    – Eric Lippert
    yesterday






  • 8




    @EricLippert Be fair. There's less of a chance of a catastrophic fire and loss of life with homeowner wiring.
    – Nic Hartley
    yesterday






  • 1




    “in-house” is a term which, if heard several times at an interview causes one to lose desire to be offered the job. Generally speaking, “in-house” can be seen as the polar opposite of “industry standard”.
    – Mawg
    18 hours ago








58




58




I believe the definition of "In-house hash function" is "Don't use our product, we have no idea what we're doing". (see Steffen's answer for a less cheeky response)
– Mike Ounsworth
yesterday




I believe the definition of "In-house hash function" is "Don't use our product, we have no idea what we're doing". (see Steffen's answer for a less cheeky response)
– Mike Ounsworth
yesterday




27




27




It means the same thing that "homeowner wiring" means to electricians.
– Eric Lippert
yesterday




It means the same thing that "homeowner wiring" means to electricians.
– Eric Lippert
yesterday




8




8




@EricLippert Be fair. There's less of a chance of a catastrophic fire and loss of life with homeowner wiring.
– Nic Hartley
yesterday




@EricLippert Be fair. There's less of a chance of a catastrophic fire and loss of life with homeowner wiring.
– Nic Hartley
yesterday




1




1




“in-house” is a term which, if heard several times at an interview causes one to lose desire to be offered the job. Generally speaking, “in-house” can be seen as the polar opposite of “industry standard”.
– Mawg
18 hours ago




“in-house” is a term which, if heard several times at an interview causes one to lose desire to be offered the job. Generally speaking, “in-house” can be seen as the polar opposite of “industry standard”.
– Mawg
18 hours ago










2 Answers
2






active

oldest

votes

















up vote
77
down vote



accepted










From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people".



Here it means developing your own hash algorithm instead of using a public one. Usually that means that it is developed by only a few people with only limited expertise in the problem area and without any public input. Thus it is very likely that the self-developed one gets eventually broken once more experts in cryptography take a look at it.



See also Why shouldn't we roll our own? and How valuable is secrecy of an algorithm?.






share|improve this answer



















  • 58




    Hearing "in-house" with anything security related is always a HUGE red flag.
    – Marie
    yesterday






  • 5




    And hearing "in-house" with anything crypto related is an even larger red flag even more often.
    – NieDzejkob
    yesterday






  • 1




    Also see Is my developer's home-brew password security right or wrong, and why?, although I suspect Dave's algorithm was much, much worse than IOTA's.
    – jpmc26
    yesterday










  • In short, in this context, "in-house" means "trouble"!
    – Muzer
    21 hours ago


















up vote
-13
down vote













I agree with the answer given an hour before this one about in-house meaning, "non-standard and probably not very sophisticated or rugged." There may still be one argument in favor of using an in-house hash. That is, it may be different enough from the standard ones out there that a hacker may decide it is too much work to figure out how to reverse engineer it. Even if you accept this argument, this sort of do-it-yourself approach should only ever be used to protect very low-value data.






share|improve this answer








New contributor




Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.














  • 26




    This line of reasoning - relying on an attacker not knowing the implementation details and hoping that they won't find out - is named "Security by Obscurity". Since this is only a slowdown, rarely really a barrier, it is generally frowned upon and strongly recommended against. One area where it still does make sense is if your assets drop rapidly in worth in a short time (days to months) and an attack after one year is much less of an impact. Most game and movie DRM / copy protection schemes fall under this category.
    – Zefiro
    yesterday






  • 6




    It's almost a trope at this point that whenever a "why is X bad?" question is posted, there will be an answer that says, paraphrasing, "well it's not that bad, because at least the attackers won't know how your version works". In other words, an appeal to Security by Obscurity. And yes, I get that this answer doesn't reject the premise, but others have done.
    – Tom W
    yesterday






  • 1




    @Zefiro: There is a difference between "hoping that an attacker doesn't find out", and considering the cost/benefit ratios for possible attacks. To be sure, the risk of a popular encryption or hashing scheme being defeated may be slight, despite the level of research into attacks on them, but the probability of a scheme no prospective attackers would care about being defeated might be even lower.
    – supercat
    yesterday






  • 2




    @Zefiro This reasoning is not about an attacker not knowing the implementation details. I think you need to read it again. It's about an attacker not having sufficient motivation to bother trying to break the algorithm. (It's still wrong, but not because it's security by obscurity, because it's not security at all. The problem is that you're very likely to drastically overestimate how much security you actually have, and that's exactly what happened here.)
    – David Schwartz
    yesterday








  • 2




    @supercat The problem is that normally, it's just security by obscurity. If you, say, shuffle an otherwise secure hash before storing (and unshuffle on retrieval and comparison), sure, that does extremely little for security, but it doesn't harm it. If all that's done is the shuffle, that's... very bad. And it's the latter case that's normally done, not the former. So people say "don't ever use it", because that's a good rule of thumb, and once you're experienced enough to know the difference, you're experienced enough to know when to ignore rules of thumb.
    – Nic Hartley
    yesterday











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














 

draft saved


draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f198134%2fwhat-does-in-house-hash-function-mean%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























2 Answers
2






active

oldest

votes








2 Answers
2






active

oldest

votes









active

oldest

votes






active

oldest

votes








up vote
77
down vote



accepted










From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people".



Here it means developing your own hash algorithm instead of using a public one. Usually that means that it is developed by only a few people with only limited expertise in the problem area and without any public input. Thus it is very likely that the self-developed one gets eventually broken once more experts in cryptography take a look at it.



See also Why shouldn't we roll our own? and How valuable is secrecy of an algorithm?.






share|improve this answer



















  • 58




    Hearing "in-house" with anything security related is always a HUGE red flag.
    – Marie
    yesterday






  • 5




    And hearing "in-house" with anything crypto related is an even larger red flag even more often.
    – NieDzejkob
    yesterday






  • 1




    Also see Is my developer's home-brew password security right or wrong, and why?, although I suspect Dave's algorithm was much, much worse than IOTA's.
    – jpmc26
    yesterday










  • In short, in this context, "in-house" means "trouble"!
    – Muzer
    21 hours ago















up vote
77
down vote



accepted










From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people".



Here it means developing your own hash algorithm instead of using a public one. Usually that means that it is developed by only a few people with only limited expertise in the problem area and without any public input. Thus it is very likely that the self-developed one gets eventually broken once more experts in cryptography take a look at it.



See also Why shouldn't we roll our own? and How valuable is secrecy of an algorithm?.






share|improve this answer



















  • 58




    Hearing "in-house" with anything security related is always a HUGE red flag.
    – Marie
    yesterday






  • 5




    And hearing "in-house" with anything crypto related is an even larger red flag even more often.
    – NieDzejkob
    yesterday






  • 1




    Also see Is my developer's home-brew password security right or wrong, and why?, although I suspect Dave's algorithm was much, much worse than IOTA's.
    – jpmc26
    yesterday










  • In short, in this context, "in-house" means "trouble"!
    – Muzer
    21 hours ago













up vote
77
down vote



accepted







up vote
77
down vote



accepted






From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people".



Here it means developing your own hash algorithm instead of using a public one. Usually that means that it is developed by only a few people with only limited expertise in the problem area and without any public input. Thus it is very likely that the self-developed one gets eventually broken once more experts in cryptography take a look at it.



See also Why shouldn't we roll our own? and How valuable is secrecy of an algorithm?.






share|improve this answer














From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people".



Here it means developing your own hash algorithm instead of using a public one. Usually that means that it is developed by only a few people with only limited expertise in the problem area and without any public input. Thus it is very likely that the self-developed one gets eventually broken once more experts in cryptography take a look at it.



See also Why shouldn't we roll our own? and How valuable is secrecy of an algorithm?.







share|improve this answer














share|improve this answer



share|improve this answer








edited yesterday

























answered yesterday









Steffen Ullrich

111k12195258




111k12195258








  • 58




    Hearing "in-house" with anything security related is always a HUGE red flag.
    – Marie
    yesterday






  • 5




    And hearing "in-house" with anything crypto related is an even larger red flag even more often.
    – NieDzejkob
    yesterday






  • 1




    Also see Is my developer's home-brew password security right or wrong, and why?, although I suspect Dave's algorithm was much, much worse than IOTA's.
    – jpmc26
    yesterday










  • In short, in this context, "in-house" means "trouble"!
    – Muzer
    21 hours ago














  • 58




    Hearing "in-house" with anything security related is always a HUGE red flag.
    – Marie
    yesterday






  • 5




    And hearing "in-house" with anything crypto related is an even larger red flag even more often.
    – NieDzejkob
    yesterday






  • 1




    Also see Is my developer's home-brew password security right or wrong, and why?, although I suspect Dave's algorithm was much, much worse than IOTA's.
    – jpmc26
    yesterday










  • In short, in this context, "in-house" means "trouble"!
    – Muzer
    21 hours ago








58




58




Hearing "in-house" with anything security related is always a HUGE red flag.
– Marie
yesterday




Hearing "in-house" with anything security related is always a HUGE red flag.
– Marie
yesterday




5




5




And hearing "in-house" with anything crypto related is an even larger red flag even more often.
– NieDzejkob
yesterday




And hearing "in-house" with anything crypto related is an even larger red flag even more often.
– NieDzejkob
yesterday




1




1




Also see Is my developer's home-brew password security right or wrong, and why?, although I suspect Dave's algorithm was much, much worse than IOTA's.
– jpmc26
yesterday




Also see Is my developer's home-brew password security right or wrong, and why?, although I suspect Dave's algorithm was much, much worse than IOTA's.
– jpmc26
yesterday












In short, in this context, "in-house" means "trouble"!
– Muzer
21 hours ago




In short, in this context, "in-house" means "trouble"!
– Muzer
21 hours ago












up vote
-13
down vote













I agree with the answer given an hour before this one about in-house meaning, "non-standard and probably not very sophisticated or rugged." There may still be one argument in favor of using an in-house hash. That is, it may be different enough from the standard ones out there that a hacker may decide it is too much work to figure out how to reverse engineer it. Even if you accept this argument, this sort of do-it-yourself approach should only ever be used to protect very low-value data.






share|improve this answer








New contributor




Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.














  • 26




    This line of reasoning - relying on an attacker not knowing the implementation details and hoping that they won't find out - is named "Security by Obscurity". Since this is only a slowdown, rarely really a barrier, it is generally frowned upon and strongly recommended against. One area where it still does make sense is if your assets drop rapidly in worth in a short time (days to months) and an attack after one year is much less of an impact. Most game and movie DRM / copy protection schemes fall under this category.
    – Zefiro
    yesterday






  • 6




    It's almost a trope at this point that whenever a "why is X bad?" question is posted, there will be an answer that says, paraphrasing, "well it's not that bad, because at least the attackers won't know how your version works". In other words, an appeal to Security by Obscurity. And yes, I get that this answer doesn't reject the premise, but others have done.
    – Tom W
    yesterday






  • 1




    @Zefiro: There is a difference between "hoping that an attacker doesn't find out", and considering the cost/benefit ratios for possible attacks. To be sure, the risk of a popular encryption or hashing scheme being defeated may be slight, despite the level of research into attacks on them, but the probability of a scheme no prospective attackers would care about being defeated might be even lower.
    – supercat
    yesterday






  • 2




    @Zefiro This reasoning is not about an attacker not knowing the implementation details. I think you need to read it again. It's about an attacker not having sufficient motivation to bother trying to break the algorithm. (It's still wrong, but not because it's security by obscurity, because it's not security at all. The problem is that you're very likely to drastically overestimate how much security you actually have, and that's exactly what happened here.)
    – David Schwartz
    yesterday








  • 2




    @supercat The problem is that normally, it's just security by obscurity. If you, say, shuffle an otherwise secure hash before storing (and unshuffle on retrieval and comparison), sure, that does extremely little for security, but it doesn't harm it. If all that's done is the shuffle, that's... very bad. And it's the latter case that's normally done, not the former. So people say "don't ever use it", because that's a good rule of thumb, and once you're experienced enough to know the difference, you're experienced enough to know when to ignore rules of thumb.
    – Nic Hartley
    yesterday















up vote
-13
down vote













I agree with the answer given an hour before this one about in-house meaning, "non-standard and probably not very sophisticated or rugged." There may still be one argument in favor of using an in-house hash. That is, it may be different enough from the standard ones out there that a hacker may decide it is too much work to figure out how to reverse engineer it. Even if you accept this argument, this sort of do-it-yourself approach should only ever be used to protect very low-value data.






share|improve this answer








New contributor




Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.














  • 26




    This line of reasoning - relying on an attacker not knowing the implementation details and hoping that they won't find out - is named "Security by Obscurity". Since this is only a slowdown, rarely really a barrier, it is generally frowned upon and strongly recommended against. One area where it still does make sense is if your assets drop rapidly in worth in a short time (days to months) and an attack after one year is much less of an impact. Most game and movie DRM / copy protection schemes fall under this category.
    – Zefiro
    yesterday






  • 6




    It's almost a trope at this point that whenever a "why is X bad?" question is posted, there will be an answer that says, paraphrasing, "well it's not that bad, because at least the attackers won't know how your version works". In other words, an appeal to Security by Obscurity. And yes, I get that this answer doesn't reject the premise, but others have done.
    – Tom W
    yesterday






  • 1




    @Zefiro: There is a difference between "hoping that an attacker doesn't find out", and considering the cost/benefit ratios for possible attacks. To be sure, the risk of a popular encryption or hashing scheme being defeated may be slight, despite the level of research into attacks on them, but the probability of a scheme no prospective attackers would care about being defeated might be even lower.
    – supercat
    yesterday






  • 2




    @Zefiro This reasoning is not about an attacker not knowing the implementation details. I think you need to read it again. It's about an attacker not having sufficient motivation to bother trying to break the algorithm. (It's still wrong, but not because it's security by obscurity, because it's not security at all. The problem is that you're very likely to drastically overestimate how much security you actually have, and that's exactly what happened here.)
    – David Schwartz
    yesterday








  • 2




    @supercat The problem is that normally, it's just security by obscurity. If you, say, shuffle an otherwise secure hash before storing (and unshuffle on retrieval and comparison), sure, that does extremely little for security, but it doesn't harm it. If all that's done is the shuffle, that's... very bad. And it's the latter case that's normally done, not the former. So people say "don't ever use it", because that's a good rule of thumb, and once you're experienced enough to know the difference, you're experienced enough to know when to ignore rules of thumb.
    – Nic Hartley
    yesterday













up vote
-13
down vote










up vote
-13
down vote









I agree with the answer given an hour before this one about in-house meaning, "non-standard and probably not very sophisticated or rugged." There may still be one argument in favor of using an in-house hash. That is, it may be different enough from the standard ones out there that a hacker may decide it is too much work to figure out how to reverse engineer it. Even if you accept this argument, this sort of do-it-yourself approach should only ever be used to protect very low-value data.






share|improve this answer








New contributor




Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









I agree with the answer given an hour before this one about in-house meaning, "non-standard and probably not very sophisticated or rugged." There may still be one argument in favor of using an in-house hash. That is, it may be different enough from the standard ones out there that a hacker may decide it is too much work to figure out how to reverse engineer it. Even if you accept this argument, this sort of do-it-yourself approach should only ever be used to protect very low-value data.







share|improve this answer








New contributor




Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









share|improve this answer



share|improve this answer






New contributor




Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









answered yesterday









Peter Knibbe

15




15




New contributor




Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.





New contributor





Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.






Peter Knibbe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.








  • 26




    This line of reasoning - relying on an attacker not knowing the implementation details and hoping that they won't find out - is named "Security by Obscurity". Since this is only a slowdown, rarely really a barrier, it is generally frowned upon and strongly recommended against. One area where it still does make sense is if your assets drop rapidly in worth in a short time (days to months) and an attack after one year is much less of an impact. Most game and movie DRM / copy protection schemes fall under this category.
    – Zefiro
    yesterday






  • 6




    It's almost a trope at this point that whenever a "why is X bad?" question is posted, there will be an answer that says, paraphrasing, "well it's not that bad, because at least the attackers won't know how your version works". In other words, an appeal to Security by Obscurity. And yes, I get that this answer doesn't reject the premise, but others have done.
    – Tom W
    yesterday






  • 1




    @Zefiro: There is a difference between "hoping that an attacker doesn't find out", and considering the cost/benefit ratios for possible attacks. To be sure, the risk of a popular encryption or hashing scheme being defeated may be slight, despite the level of research into attacks on them, but the probability of a scheme no prospective attackers would care about being defeated might be even lower.
    – supercat
    yesterday






  • 2




    @Zefiro This reasoning is not about an attacker not knowing the implementation details. I think you need to read it again. It's about an attacker not having sufficient motivation to bother trying to break the algorithm. (It's still wrong, but not because it's security by obscurity, because it's not security at all. The problem is that you're very likely to drastically overestimate how much security you actually have, and that's exactly what happened here.)
    – David Schwartz
    yesterday








  • 2




    @supercat The problem is that normally, it's just security by obscurity. If you, say, shuffle an otherwise secure hash before storing (and unshuffle on retrieval and comparison), sure, that does extremely little for security, but it doesn't harm it. If all that's done is the shuffle, that's... very bad. And it's the latter case that's normally done, not the former. So people say "don't ever use it", because that's a good rule of thumb, and once you're experienced enough to know the difference, you're experienced enough to know when to ignore rules of thumb.
    – Nic Hartley
    yesterday














  • 26




    This line of reasoning - relying on an attacker not knowing the implementation details and hoping that they won't find out - is named "Security by Obscurity". Since this is only a slowdown, rarely really a barrier, it is generally frowned upon and strongly recommended against. One area where it still does make sense is if your assets drop rapidly in worth in a short time (days to months) and an attack after one year is much less of an impact. Most game and movie DRM / copy protection schemes fall under this category.
    – Zefiro
    yesterday






  • 6




    It's almost a trope at this point that whenever a "why is X bad?" question is posted, there will be an answer that says, paraphrasing, "well it's not that bad, because at least the attackers won't know how your version works". In other words, an appeal to Security by Obscurity. And yes, I get that this answer doesn't reject the premise, but others have done.
    – Tom W
    yesterday






  • 1




    @Zefiro: There is a difference between "hoping that an attacker doesn't find out", and considering the cost/benefit ratios for possible attacks. To be sure, the risk of a popular encryption or hashing scheme being defeated may be slight, despite the level of research into attacks on them, but the probability of a scheme no prospective attackers would care about being defeated might be even lower.
    – supercat
    yesterday






  • 2




    @Zefiro This reasoning is not about an attacker not knowing the implementation details. I think you need to read it again. It's about an attacker not having sufficient motivation to bother trying to break the algorithm. (It's still wrong, but not because it's security by obscurity, because it's not security at all. The problem is that you're very likely to drastically overestimate how much security you actually have, and that's exactly what happened here.)
    – David Schwartz
    yesterday








  • 2




    @supercat The problem is that normally, it's just security by obscurity. If you, say, shuffle an otherwise secure hash before storing (and unshuffle on retrieval and comparison), sure, that does extremely little for security, but it doesn't harm it. If all that's done is the shuffle, that's... very bad. And it's the latter case that's normally done, not the former. So people say "don't ever use it", because that's a good rule of thumb, and once you're experienced enough to know the difference, you're experienced enough to know when to ignore rules of thumb.
    – Nic Hartley
    yesterday








26




26




This line of reasoning - relying on an attacker not knowing the implementation details and hoping that they won't find out - is named "Security by Obscurity". Since this is only a slowdown, rarely really a barrier, it is generally frowned upon and strongly recommended against. One area where it still does make sense is if your assets drop rapidly in worth in a short time (days to months) and an attack after one year is much less of an impact. Most game and movie DRM / copy protection schemes fall under this category.
– Zefiro
yesterday




This line of reasoning - relying on an attacker not knowing the implementation details and hoping that they won't find out - is named "Security by Obscurity". Since this is only a slowdown, rarely really a barrier, it is generally frowned upon and strongly recommended against. One area where it still does make sense is if your assets drop rapidly in worth in a short time (days to months) and an attack after one year is much less of an impact. Most game and movie DRM / copy protection schemes fall under this category.
– Zefiro
yesterday




6




6




It's almost a trope at this point that whenever a "why is X bad?" question is posted, there will be an answer that says, paraphrasing, "well it's not that bad, because at least the attackers won't know how your version works". In other words, an appeal to Security by Obscurity. And yes, I get that this answer doesn't reject the premise, but others have done.
– Tom W
yesterday




It's almost a trope at this point that whenever a "why is X bad?" question is posted, there will be an answer that says, paraphrasing, "well it's not that bad, because at least the attackers won't know how your version works". In other words, an appeal to Security by Obscurity. And yes, I get that this answer doesn't reject the premise, but others have done.
– Tom W
yesterday




1




1




@Zefiro: There is a difference between "hoping that an attacker doesn't find out", and considering the cost/benefit ratios for possible attacks. To be sure, the risk of a popular encryption or hashing scheme being defeated may be slight, despite the level of research into attacks on them, but the probability of a scheme no prospective attackers would care about being defeated might be even lower.
– supercat
yesterday




@Zefiro: There is a difference between "hoping that an attacker doesn't find out", and considering the cost/benefit ratios for possible attacks. To be sure, the risk of a popular encryption or hashing scheme being defeated may be slight, despite the level of research into attacks on them, but the probability of a scheme no prospective attackers would care about being defeated might be even lower.
– supercat
yesterday




2




2




@Zefiro This reasoning is not about an attacker not knowing the implementation details. I think you need to read it again. It's about an attacker not having sufficient motivation to bother trying to break the algorithm. (It's still wrong, but not because it's security by obscurity, because it's not security at all. The problem is that you're very likely to drastically overestimate how much security you actually have, and that's exactly what happened here.)
– David Schwartz
yesterday






@Zefiro This reasoning is not about an attacker not knowing the implementation details. I think you need to read it again. It's about an attacker not having sufficient motivation to bother trying to break the algorithm. (It's still wrong, but not because it's security by obscurity, because it's not security at all. The problem is that you're very likely to drastically overestimate how much security you actually have, and that's exactly what happened here.)
– David Schwartz
yesterday






2




2




@supercat The problem is that normally, it's just security by obscurity. If you, say, shuffle an otherwise secure hash before storing (and unshuffle on retrieval and comparison), sure, that does extremely little for security, but it doesn't harm it. If all that's done is the shuffle, that's... very bad. And it's the latter case that's normally done, not the former. So people say "don't ever use it", because that's a good rule of thumb, and once you're experienced enough to know the difference, you're experienced enough to know when to ignore rules of thumb.
– Nic Hartley
yesterday




@supercat The problem is that normally, it's just security by obscurity. If you, say, shuffle an otherwise secure hash before storing (and unshuffle on retrieval and comparison), sure, that does extremely little for security, but it doesn't harm it. If all that's done is the shuffle, that's... very bad. And it's the latter case that's normally done, not the former. So people say "don't ever use it", because that's a good rule of thumb, and once you're experienced enough to know the difference, you're experienced enough to know when to ignore rules of thumb.
– Nic Hartley
yesterday


















 

draft saved


draft discarded



















































 


draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f198134%2fwhat-does-in-house-hash-function-mean%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

數位音樂下載

When can things happen in Etherscan, such as the picture below?

格利澤436b