6 ms·

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and cal

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic lists" when they want to read more about rainbow tables. Let alone the completely mad communication you'll get with people in the company. > We implemented magic sodium suffix in our application this week, attackers won't be able to use magic lists when our magic data leaks. >> What? > You know, irreversible magic? >> ...

merrington 8y ago
How many non-engineers would you expect to take the interest/time to investigate rainbow tables after this? Also, if you follow the link to the actual presentation (https://sudo.pagerduty.com/for_everyone/#hashing https://sudo.pagerduty.com/for_everyone/#hashing for the lazy) then you'll see the author DOES indeed call it hashing, before switching to "magic" so as to make it easier for individuals without a technical background to not have to constantly think about what the term means. Also, if you continue to RTFA, > That said, I didn’t want to mislead people. So we chose to be clear to them that there is a technical term; it’s just not going to be important for the rest of the content. If it's someone job to provide reports/updates on something related to the concept, yes they should know it, for anyone else in a non-technical role, why does it really matter?
- flipp3r 8y ago
  > Also, if you continue to RTFA, I RTFpresentations even. Naming Hashing and then switching to Magic is just confusing for everyone involved. Again; it completely ruins effective communication. > for anyone else in a non-technical role, why does it really matter? They're getting security training on the topic of hashing. How does it not matter?? Employees will have to adjust their communication to toddler level anytime they need to talk about security to others.
  - scrollaway 8y ago
    > They're getting security training on the topic of hashing. How does it not matter?? They're getting taught good password health. You don't need to know what hashing is to know good password health. I shouldn't get upset over comments but it's headdeskingly frustrating to read comments like yours from people who should know better and who, ultimately, contribute to worse personal security for everybody. Comments like yours are one of the causes behind many people turning their head away at security, not bothering because the barrier of entry is too high and they're made to feel like if they don't have it perfect why bother. Damn it. The guy communicated pretty damn well if he got 30 employees switching to password managers on their own without actually saying it's required. So instead of criticizing, take it as an opportunity to learn and revise your beliefs.
    - sillysaurus3 8y ago
      There's no reason to get personal. We're all on the same side here.
- fjsolwmv 8y ago
  It doesn't make it easier though. Hashing makes a hash of the password -- chops it and scrambles it so you can see what it came from. Calling everything "magic" just conflates everything with e everything else, confusing everyone.
alexcnwy 8y ago
I think you totally miss the point. Explaining something by analogy can be the most effective way of "getting it". Everyone is different. You definitely cannot make such a bold statement about whether the approach was valid.
zachrose 8y ago
Devising a new, more familiar name for something like hashing is a good idea here because it communicates that “this is a complex thing handled by specialists, but it’s implications are important to us.”
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
cbhl 8y ago
Concepts can have more than one name. An important part of preparing a training or presentation is understanding your audience, and using names that resonate with them. If this had been a freshman college crypto class, the word "oracle" (https://security.stackexchange.com/questions/10617/what-is-a-cryptographic-oracle https://security.stackexchange.com/questions/10617/what-is-a...) may have been used instead, to indicate that the exact details of hash reversing can be abstracted away and that the key detail is that it's much faster than brute force would suggest.
mightybyte 8y ago
Completely agree. In particular I think the word "hash" is easy to explain. Just tell them it's kind of like the process of creating corn beef hash. Something goes into the process, and when it comes it it's unrecognizable and and you can reverse the process to get a cow back.
- cyberferret 8y ago
  > it's unrecognizable and and you can reverse the process to get a cow back. I am assuming you meant to type "can't reverse the process" here? (and drop the extra 'and'). Apologies for being seemingly pedantic, but the distinction is important here for the very definition of a hash.
  - mightybyte 8y ago
    Yep, thanks for the correction.
alangpierce 8y ago
To be clear, the "magic list" thing is focused on non-engineers, who likely will never need to read or write the term "rainbow table" as part of their job, they just need to be convinced that it's important to use a password manager. The presentation also mentions the technical terminology but switches to less intimidating terminology afterward. The presentation for engineers uses "hash", "rainbow table", etc without ever using the less intimidating terminology: https://sudo.pagerduty.com/for_engineers/ https://sudo.pagerduty.com/for_engineers/
SilasX 8y ago
When teaching about bitcoin, I say “scrambler function” instead of “hash function” because it better conveys the intuition of what they do — even though it’s longer and non-standard. (Most people I talk to don’t immediately associate “hash” with “make a hash of the whole thing” ie mess it up). Although I also make sure to give the “decoder ring” and the end to list the actual standard terms for the concepts discussed.
sverige 8y ago
OK, so "rainbow table" is what we all call them, but frankly I've always found that name to be baffling. Why are they called that? What is the origin of the name? What do they have to do with rainbows? Yes, googling "magic list" will not produce the same results as "rainbow table," but it's a good substitute when teaching non-technical people the concept. It might even help them avoid googling unsuccessfully for the origin of the actual name. (If you know the origin, I'd love to know, and so would the people at Wikipedia.)
- ams6110 8y ago
  A real rainbow represents all colors: the full spectrum. A rainbow table has all possible passwords within its spectrum (8 characters, alphanumeric, or however it's defined). A non-technical term I might use is to call a rainbow table a "reverse phone book for passwords"
  - sverige 8y ago
    Fair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades. Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?
    - ams6110 8y ago
      I don't have a source, but the analogy seems obvious to me. If you're more curious, I guess you could do your own research?
      - sverige 8y ago
        I have, actually. I can't find a reliable source for the origin of the name, even in the original papers written to describe them.
      - fjsolwmv 8y ago
        There's no need to comment if you aren't sharing any information or ideas.
techman9 8y ago
> That said, I didn’t want to mislead people. So we chose to be clear to them that there is a technical term; it’s just not going to be important for the rest of the content.

merrington 8y ago

How many non-engineers would you expect to take the interest/time to investigate rainbow tables after this? Also, if you follow the link to the actual presentation (https://sudo.pagerduty.com/for_everyone/#hashing https://sudo.pagerduty.com/for_everyone/#hashing for the lazy) then you'll see the author DOES indeed call it hashing, before switching to "magic" so as to make it easier for individuals without a technical background to not have to constantly think about what the term means. Also, if you continue to RTFA, > That said, I didn’t want to mislead people. So we chose to be clear to them that there is a technical term; it’s just not going to be important for the rest of the content. If it's someone job to provide reports/updates on something related to the concept, yes they should know it, for anyone else in a non-technical role, why does it really matter?

flipp3r 8y ago
> Also, if you continue to RTFA, I RTFpresentations even. Naming Hashing and then switching to Magic is just confusing for everyone involved. Again; it completely ruins effective communication. > for anyone else in a non-technical role, why does it really matter? They're getting security training on the topic of hashing. How does it not matter?? Employees will have to adjust their communication to toddler level anytime they need to talk about security to others.
- scrollaway 8y ago
  > They're getting security training on the topic of hashing. How does it not matter?? They're getting taught good password health. You don't need to know what hashing is to know good password health. I shouldn't get upset over comments but it's headdeskingly frustrating to read comments like yours from people who should know better and who, ultimately, contribute to worse personal security for everybody. Comments like yours are one of the causes behind many people turning their head away at security, not bothering because the barrier of entry is too high and they're made to feel like if they don't have it perfect why bother. Damn it. The guy communicated pretty damn well if he got 30 employees switching to password managers on their own without actually saying it's required. So instead of criticizing, take it as an opportunity to learn and revise your beliefs.
  - sillysaurus3 8y ago
    There's no reason to get personal. We're all on the same side here.
fjsolwmv 8y ago
It doesn't make it easier though. Hashing makes a hash of the password -- chops it and scrambles it so you can see what it came from. Calling everything "magic" just conflates everything with e everything else, confusing everyone.

alexcnwy 8y ago

I think you totally miss the point. Explaining something by analogy can be the most effective way of "getting it". Everyone is different. You definitely cannot make such a bold statement about whether the approach was valid.

zachrose 8y ago

Devising a new, more familiar name for something like hashing is a good idea here because it communicates that “this is a complex thing handled by specialists, but it’s implications are important to us.”

deleted 8y ago
[deleted]
deleted 8y ago
[deleted]

cbhl 8y ago

Concepts can have more than one name. An important part of preparing a training or presentation is understanding your audience, and using names that resonate with them. If this had been a freshman college crypto class, the word "oracle" (https://security.stackexchange.com/questions/10617/what-is-a-cryptographic-oracle https://security.stackexchange.com/questions/10617/what-is-a...) may have been used instead, to indicate that the exact details of hash reversing can be abstracted away and that the key detail is that it's much faster than brute force would suggest.

mightybyte 8y ago

Completely agree. In particular I think the word "hash" is easy to explain. Just tell them it's kind of like the process of creating corn beef hash. Something goes into the process, and when it comes it it's unrecognizable and and you can reverse the process to get a cow back.

cyberferret 8y ago
> it's unrecognizable and and you can reverse the process to get a cow back. I am assuming you meant to type "can't reverse the process" here? (and drop the extra 'and'). Apologies for being seemingly pedantic, but the distinction is important here for the very definition of a hash.
- mightybyte 8y ago
  Yep, thanks for the correction.

alangpierce 8y ago

To be clear, the "magic list" thing is focused on non-engineers, who likely will never need to read or write the term "rainbow table" as part of their job, they just need to be convinced that it's important to use a password manager. The presentation also mentions the technical terminology but switches to less intimidating terminology afterward. The presentation for engineers uses "hash", "rainbow table", etc without ever using the less intimidating terminology: https://sudo.pagerduty.com/for_engineers/ https://sudo.pagerduty.com/for_engineers/

SilasX 8y ago

When teaching about bitcoin, I say “scrambler function” instead of “hash function” because it better conveys the intuition of what they do — even though it’s longer and non-standard. (Most people I talk to don’t immediately associate “hash” with “make a hash of the whole thing” ie mess it up). Although I also make sure to give the “decoder ring” and the end to list the actual standard terms for the concepts discussed.

sverige 8y ago

OK, so "rainbow table" is what we all call them, but frankly I've always found that name to be baffling. Why are they called that? What is the origin of the name? What do they have to do with rainbows? Yes, googling "magic list" will not produce the same results as "rainbow table," but it's a good substitute when teaching non-technical people the concept. It might even help them avoid googling unsuccessfully for the origin of the actual name. (If you know the origin, I'd love to know, and so would the people at Wikipedia.)

ams6110 8y ago
A real rainbow represents all colors: the full spectrum. A rainbow table has all possible passwords within its spectrum (8 characters, alphanumeric, or however it's defined). A non-technical term I might use is to call a rainbow table a "reverse phone book for passwords"
- sverige 8y ago
  Fair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades. Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?
  - ams6110 8y ago
    I don't have a source, but the analogy seems obvious to me. If you're more curious, I guess you could do your own research?
    - sverige 8y ago
      I have, actually. I can't find a reliable source for the origin of the name, even in the original papers written to describe them.
    - fjsolwmv 8y ago
      There's no need to comment if you aren't sharing any information or ideas.

techman9 8y ago

> That said, I didn’t want to mislead people. So we chose to be clear to them that there is a technical term; it’s just not going to be important for the rest of the content.