A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
2answers
29 views

Related-password hash security

Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb. We compute the hashes hasha, ...
2
votes
2answers
51 views

SHA and “Bits of Security”

I've researched several forms of encryption/hashing and have often come across the term "bits of security". For example, at least one source claimed SHA-256 = AES128 = ECC256 = 128 bits of security. ...
-6
votes
0answers
40 views

I have litteraly no more options of how to crack this hash. PLZ HELP D: [on hold]

I have found this old hash laying around and I have no idea how to crack it :P my hash: 7b62d4ef52a09bb505055296faa4ffcc I have tried everything and have come up with nadda :l I have tried brute ...
-1
votes
1answer
35 views

Can I test/determine all decryption types on an unkown filetype. I do have the password [on hold]

I have a file that's nearly 200Mb. It was reportedly packed/encrypted with Kruptos 2. But it has a .~enc extension. The header of the file is pure gibberish. Running file says it's data running ...
-1
votes
3answers
63 views

Can I safely use my own statistics to assess password strength on number of times a password is used?

Lets assume I want to give my hypothetic 10mio users userbase a good feedback on their password strength. Besides the classical entropy tests and top500 list of bad passwords, I might want it to be ...
7
votes
4answers
1k views

Should the password of a password protected channel be hashed?

Let's take a chat system, where any user can create a channel with a password protection. Thus, other users may only join using the channel password. This password is therefore known to every person ...
2
votes
0answers
27 views

How do I verify a GPG symmetrically encrypted file? [migrated]

I created an encrypted file with symmetric encryption. gpg -c 50GBfile Now I want to delete the original. Before I delete the original, I want to verify the integrity of the encrypted file. Does ...
0
votes
2answers
70 views

How can I identify this hash? [closed]

I'm trying to decrypt my router's root password, since I only have access to a simple admin account that doesn't have root privileges. Here is the passwd file: 0:F.bCrWv/Oxp6.:0:0:root:/home:/bin/sh ...
0
votes
2answers
84 views

Saving passwords decryptable for later usage

I'm in a situation where I need to calculate a hash of the result of the password in plain text plus some random chars representing a session. The gained hash will be compared to another hash that is ...
0
votes
1answer
29 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that tracks IP addresses to prevent abuse, ...
0
votes
2answers
52 views

What is the collision likelihood of MD5 when non-numeric values are removed?

Start with a unique identifier String macAddress = "CC:3A:61:24:D6:96"; Hash the identifier via MD5 implementation String hash = md5(macAddress); //bd37f780e10244cf28810b969559ad5b Remove all ...
123
votes
18answers
12k views

What is a good analogy to explain to a layman why passwords should be hashed?

Note: This is not an actual situation I'm currently in. Assume your boss is one of those old-fashioned computer-illiterate managers and wants to store the passwords in plaintext to simplify ...
1
vote
2answers
52 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
27
votes
7answers
4k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Edit Looking for ...
1
vote
0answers
15 views

PBKDF2 hashing over TLS for encrptig password [closed]

i wanna use PBKDF2 hashing over TLS for encrypting password and session and that way stop hackers from breaking into my connection. How to do it in java.
1
vote
2answers
78 views

Is there any way to log in with a hash?

I've understood that the following steps are taken when I log in to a site: 1. My password is hashed 2. The hash is compared to what's stored in the database. 3. If the hashes are equal, I can log in. ...
0
votes
1answer
95 views

Save password on user-side for autologin

If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt. So the user wants to login, types in the password, ...
0
votes
2answers
146 views

Reversible Hash Function?

Is there any reversible hash function? The hash function like SHA and MD5 are not reversible. I would like to know if there exist some reversible hash functions?
0
votes
2answers
88 views

How to generate an unpredictable but short string? [closed]

I want to built some short urls for uploaded files and links on my own server. Simple enough, I upload files and my script returns me a link. On access, the link is translated to the file and download ...
-1
votes
4answers
192 views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
1
vote
2answers
77 views

Is it unsafe to hash one password with more than one salt?

I'm asking my question here since I was not able to find an answer anywhere. I have written a piece of software which stores pretty delicate passwords. I have used BCrypt as hashing algorithm with an ...
0
votes
1answer
97 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
0
votes
1answer
56 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
2
votes
3answers
73 views

Client-side hashing of password before sending it from login form [duplicate]

I have just realized, that my web application is sending unencrypted passwords from login form. It's just like that -- I've analysed, that string sent by user from login form is hashed with MD5 (which ...
3
votes
3answers
613 views

Is this a secure way of storing passwords? [duplicate]

So a couple years ago when I was learning basic back-end web development, I found a tutorial for creating a basic log in system. I haven't done much modification to the code since, but I have the ...
3
votes
4answers
577 views

How to properly anonymize data, if hashing isn't enough?

Today there are news on Bruce Schneier's blog and ArsTechnica about how NY City released information about Cab/Taxi drivers, their trips, and so on. Basically, sensitive information was simply MD5 ...
0
votes
1answer
52 views

Using hashed password as secret key for hmac to avoid exchange of secret between server and client

I'm currently trying to improve our API to be more restful, therfore avoid any state on the server. I want to accomplish this with a hmac token, appended on every request. The hmac will be made with ...
0
votes
3answers
53 views

How to secure Password and Salt on a deployed application

I have a question regarding one step of protection more than salt/hash. I work on an application that is distributed to many clients and then deployed on their networks. If I set a password on one ...
16
votes
8answers
3k views

Won't all hashes collide after enough iterations (with a static salt)?

We all know that we're supposed to take a fairly slow hashing algorithm, salt the password, and run the hash for many iterations. Let's say that I'm following almost everything except for one rule, ...
1
vote
1answer
92 views

I know scrypt is newer than bcrypt, but is there any reason it would be weaker?

From what I read, scrypt is (on paper) more secure than bcrypt, but it's pretty new so it's better to let it get time-tested and scrutinized first. However, is there any good, compelling reason to ...
11
votes
7answers
698 views

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
1
vote
1answer
122 views

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
2
votes
2answers
104 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
4
votes
3answers
125 views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...
9
votes
3answers
4k views

How often do two users use the same password

If no two users use the same password, then in theory salting the password hash is not needed. How often, in practice, do two users have the same password?
70
votes
8answers
9k views

Convincing my manager to use salts

My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active ...
1
vote
1answer
55 views

Ldap differences between {crypt} and {CRYPT}

I recently stumbled upon some password entries in LDAP marked with the {crypt} scheme. Since all recent entries are {CRYPT}, I was wondering what the differences between the hash algorithms are.
0
votes
2answers
206 views

Storing multiple hashes to prevent collisions, security risk?

This is all just for curiosity's sake, so discussion on which hashing algorithm is harder/better/faster/stronger is irrelevant. But my question/thought is this.. With regards to password storage, and ...
1
vote
1answer
135 views

Theoretical home grown password options, or what is it that SCrypt, BCrypt, PBKDF2 does that is so special?

I'm developing a personal web framework, nothing internetty, and probably not even anything that will ever go on my personal LAN. And looking for password advice people seem to only recommend those ...
42
votes
5answers
4k views

Is it safe to tell your users what kind of hashing algorithm you use?

For example, on the user registration page, is it safe to tell people "Your password will be stored as a one-way hash using the (whatever) algorithm."
-1
votes
4answers
70 views

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
1
vote
4answers
150 views

Hashing Email Address and Contacting User

I am thinking about a log-in web service that would store a users username, password, and (optional) email address. If they forget their username or password, they can have their username and a ...
0
votes
2answers
82 views

Is a long salt usually sufficient for security purposes, even with MD5?

I always hear that MD5 is too fast for effective password crypto because you can crack up to 6 characters very quickly (or is this number higher now)? But what if the salt you use is really long and ...
0
votes
2answers
54 views

Why RSA signatures based on the hash of the message? [closed]

Why RSA signatures based on the hash of the message rather than the message itself?
2
votes
2answers
424 views

Protecting hidden form fields

The scenario is as follows: An application has a web interface through which data can be configured. The data to consider for this question is Users with a many-to-many relationship with Groups. ...
1
vote
1answer
44 views

Log file checksums

I am told that you can tell if the log file (like from ripping a CD) has been modified by its checksum. How? How do you bypass this if you wanted to modify it?
2
votes
1answer
58 views

Identical lanman hashes on AD accounts?

I ran metasploit's smart_hashdump module against my (2008r2) domain controllers, trying to find any accounts that may still have lanman hashes in place. These should have been disabled long ago. I'm ...
1
vote
1answer
99 views

What are the enhancements of SHA1 compared to MD5?

I am looking for enhancements of SHA1 when its compared to MD5. But I am not talking about just heap sizes. I am talking about different enhancements than heap size. Also, I think md5 is faster than ...
0
votes
2answers
73 views

Security of this account login system

I have an idea to implement a account system using email and passwords for games. Im intending to have the account creation and forget password systems on a webpage. So if users will have to access ...
1
vote
2answers
39 views

Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...