As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...
Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?
I've read about the concepts presented in these two questions: Pre-hash password before applying bcrypt to avoid restricting password length Would it make sense to use Bcrypt and PBKDF2 together? I ...
I have a (hobby) web site that runs only on SSL. The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to secure it as much as ...
I'm pretty new to the whole password hashing business, so I might be missing something obvious. I was looking at the bcrypt algorithm, in particular BCrypt.Net, and I was wondering if it wouldn't be ...
PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...