Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
Possible Duplicate: Why is using salt more secure? Why would salt not have prevented LinkedIn passwords from getting cracked? Recently I decided that I wanted to learn more about web ...
It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
Many of you may have seen How Apple and Amazon Security Flaws Led to My Epic Hacking, where a Wired reporter's Amazon, Apple, Gmail, and Twitter accounts were successfully hacked. The hacker followed ...
First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
I always thought that salts is simply used to prevent rainbow tables to be used. Other have suggest they should be unique on a per account basis. Currently i have been using a config file to use as ...
Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
If only the password hash is stored and the user inputs the original password, how does the program know that it is correct? I guess it could check all the possible salts but if there are 32bit salts ...
I do this to encrypt a single file: openssl aes-256-cbc -a -salt -in file.txt -out file.enc and then type in some regular plaintext password. I do not understand how -salt enhances the security of ...