Password Security & Authentication

2/21/2018

Cloudflare contributed to the 'Pwned Passwords' service by designing and implementing API endpoints that support anonymised range queries. This allows clients to search for breached passwords without disclosing a complete unsalted password hash to the service. The implementation uses k-anonymity by truncating password hashes to create 'buckets', enabling clients to download all leaked hashes within a bucket and perform an offline check. This approach avoids the higher overhead of Private Set Intersection (PSI) techniques.

2/21/2018

This post details the historical context and ongoing challenges in password security, highlighting the continued prevalence of insecure storage and weak user practices. It explains cryptographic hashing, salting, and the limitations of these techniques against modern cracking methods like GPU-based attacks and brute-force. The post emphasizes the need for good UX, improved developer education, and eliminating password reuse. It introduces the concept of credential stuffing due to password reuse and advocates for password managers and Two-Factor Authentication. For developers, it suggests abolishing bad composition rules and supporting 2FA. A key contribution is the design of a range search API for validating leaked passwords without sharing raw hashes, contributing to Troy Hunt's Pwned Passwords database.

11/28/2012

This post details Cloudflare's decision to implement Time-based One-time Password (TOTP) authentication for customer accounts, leveraging RFC 6238. It discusses the rationale behind choosing TOTP over SMS-based or fob-based systems, highlighting the security benefits of time-sensitive codes and the privacy concerns with Google's implementation. The post praises Authy's app for its elegant implementation of TOTP, its ability to manage multiple tokens, revoke tokens if a phone is lost, keep clocks in sync without network access, and seamlessly sync accounts across devices. It also notes Authy's use of SHA-2 and 256-bit keys compared to Google Authenticator's SHA-1 and 128-bit keys.

11/28/2012

This post introduces the availability of two-factor authentication (2FA) for all Cloudflare accounts, integrating with Authy's service. It details the setup process, which involves mobile phone verification via SMS, downloading the Authy app, and entering a setup PIN. The post explains that 2FA requires an email, password, and a time-based authentication token generated by the Authy app for login. It also mentions that authentication tokens are valid for 30 seconds and can be stored for 14 days, and provides instructions for resetting the account if a phone is lost.

6/19/2012

This post introduces and elaborates on Kerckhoff's Principle, emphasizing that the security of a system should rely on the strength of its algorithms and the secrecy of keys, not on the secrecy of the system's design itself. It uses the example of password storage with bcrypt to illustrate this principle, stating that the security of hashed passwords and salts relies solely on the bcrypt algorithm, not on keeping the storage mechanism secret. It also contrasts this with the Enigma machine, whose security was broken by attacking its mathematical flaws despite knowing its design.

6/18/2012

This post details the evolution of password storage from plain text to salted hashes, highlighting the vulnerabilities of each. It introduces bcrypt as a solution to the problem of fast hash functions enabling brute-force attacks even with salts. The post explains the concept of a 'cost' parameter in bcrypt to slow down hashing over time, making it resistant to Moore's Law. Cloudflare's adoption of bcrypt for its password database is highlighted as a key security upgrade.