How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
Nowadays, if we expect to store user password securely, we need at least do the following thing $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have ...
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
I was reading this interesting question: Is my developer's home-brew password security right or wrong, and why? It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered. The algorithm always produces 20 character long ...
I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the ...
Which is better? Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token. Generate a random token and store it in the ...
According to Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet , the recommended solution to protect web site from CSRF attacking is to implement Synchronizer Token Pattern. And This requires ...
I'm working on some code that attempts to identify files whose contents appear to be "random". As such, I'm looking for statistical measures that can be used to identify such randomness. I've ...
What can a web application developer do to protect user information from powerful adversaries like the NSA or China
Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...