A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
1answer
75 views

What kind of encoding/hash it is [closed]

I have email which is stored in Cookie : %2FGl%F8%7E%06%F1S%FEF%10%E0T%B3%95%82BK%D9%D3%94%BC%AE%E1 which is sth like this after convert it with this tool : ...
3
votes
2answers
127 views

Why use PBKDF2 over multiple iterations of a another cryptographic hash function?

People often recommend PBKDF2 over using hash functions directly, but typically they compare PBKDF2 to a single unsalted hash. What advatages are there to using PBKDF2 over multiple iterations of a ...
114
votes
5answers
11k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
15
votes
1answer
1k views

Why does Facebook bother comparing old and new passwords?

An answer to this question says Facebook generates a bunch of password guesses to see if they hash the same as a previous version of the password. Why bother? If a service forces every password to ...
0
votes
1answer
49 views

Verify external data files for an application

I have a C++ application with an algorithm, whose usage I want to protect. The application needs several input data files to work (those may change for each client). My goal is to allow only ...
2
votes
4answers
336 views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesnt even have support for SHA or other algorithms. But I can think of quite a few advantages, ...
0
votes
1answer
90 views

Review of approach to client-side only hashing and encryption for web application

Background: I have little knowledge of hashing and encryption, so please bear with me. I have posted a related question here: ...
1
vote
0answers
87 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
4
votes
3answers
159 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...
1
vote
3answers
194 views

Is a file hash checking system 100% secure and non-bypassable/fakable?

I'm building an open source distributed (and partly offline replicated, as it's assumed that the network will be unstable) CMS and one of the core system 'job' will be to group all the files and ...
1
vote
2answers
96 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
2
votes
1answer
82 views

What to do with the extra bytes in ECDHE-RSA-AES-GCM-SHA?

I'm trying to implement, as an exercise, a protocol based on the cipher suite ECDHE-RSA-AES256-GCM-SHA384. As I understand things, ECDHE is used for the key exchange, RSA for the authenticity of the ...
6
votes
8answers
1k views

Does truncating the cryptographic hash make it impossible to crack?

I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae I store that directly in the ...
0
votes
2answers
450 views

Is my hashing method secure? [duplicate]

I use bcrypt (32 rounds) and once the hash is produced, I get the sha512 of that hash and I then hash that with blow fish and once that is done, I hash it again with sha512 with a salt that has been ...
0
votes
1answer
95 views

Is bcrypt suitable for modern use? [duplicate]

When the subject of password hashing comes up, a lot of developers get exasperated by people using outdated, broken, or hand-rolled hashing schemes, and I frequently hear "just use bcrypt!" repeated ...
1
vote
1answer
125 views

Hash Security of Windows 7 Password

I need to find some materials about how Security Accounts Manager(SAM) works in windows 7+. I am confused with the storage format of hashed value. Many materials (such as, 1) tells me that it uses ...
3
votes
2answers
160 views

How does my bank knows my second and forth chars of my password

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
175
votes
6answers
20k views

How to store salt?

Nowadays, if we expect to store user password securely, we need at least do the following thing $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have ...
17
votes
4answers
3k views

How secure is Java's hashCode()?

On our views in a Java web application, currently I am using hashCode as Id's for objects so that at server end I can get the same object back. However, I am wondering how secure Java's hashCode ...
36
votes
3answers
15k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
5
votes
3answers
513 views

Does it make any sense to alter a hashed password? [duplicate]

I've always wondered if it would make any sense to put fake characters into a hashed password? For example this is my password: 1234 and after hashing the password , this is the result: abcd Then ...
0
votes
1answer
78 views
1
vote
3answers
370 views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . ...
2
votes
2answers
620 views

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
2
votes
1answer
295 views

ASIC/FPGA hardwares to compute Scrypt hashes [closed]

this company claim Scrypt mining by ASIC (on crypto currencies who use scrypt hashing as proof of work) scrypt is made to keep ASIC/FPGA attackers away, is that claim expired?
0
votes
2answers
78 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
3answers
104 views

Using a Hash as a Salt? [duplicate]

Ive done a bit of reading on the subject of Hashes and Salts and I came up with an idea for a salting scheme but I wanted to check it with some people more learned than myself. My basic idea is to ...
3
votes
1answer
132 views

Improving magnetic stripe card security with a “magnetic noise” hash?

I was reading the wiki on magnetic stripe cards when I stumbled across this sentence: "Magnetic stripe cloning can be detected by the implementation of magnetic card reader heads and firmware that can ...
-1
votes
1answer
53 views

login not working using hash_pbkdf2 [closed]

i am storing the password using hash_pbkdf2 but now ive hit on a problem my code : 1.for register $salt = openssl_random_pseudo_bytes(125);//salt $final_pass = ...
1
vote
2answers
3k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
17
votes
8answers
11k views

Why do people still use/recommend MD5 if it is cracked since 1996?

It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996 Therefore we suggest that in the future MD5 should no longer be implemented in ...
34
votes
15answers
5k views

Why do people think that this is bad way to hash passwords?

Well, please tell me, what's wrong with this code: $password = "hello"; $password = md5($password); for($i=1;$i<20;$i++){ $password = md5($password); } It's exactly the same as this one: ...
0
votes
1answer
133 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
2
votes
1answer
176 views

Legality of downloading leaked hashes / attempt cracking [closed]

Note: I realize there is no legally binding talk hereinafter. There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep ...
1
vote
1answer
182 views

Retrieve RAR Password through Extracted File

So I was wondering about something, but for the simplicity, consider this example: You have a file with n encrypted files in it, of which one is called 'Note.txt' You also happen to have another ...
0
votes
1answer
58 views

Storing third party auth info; Is this secure?

I have a feature request to connect my PHP web-app to the users mail server. I have usually strayed away from this type of work as it will mean storing the users email passwords. My question: is it ...
0
votes
1answer
97 views

Breaking encryption with hash value of password?

Can you break an encrypted volume if you know the source code of the crypto-tool used and the hash value of the secret passphrase? Why is it not possible to just reverse engineer the passphrase ...
1
vote
1answer
76 views

Is it possible to hash bcrypt passwords more securely?

I'm wondering if it's possible to increase the work factor of an already encrypted bcrypt password. e.g. I have a password that was encrypted with a work factor of 5, is it possible to increase the ...
0
votes
1answer
56 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
6
votes
3answers
2k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
1
vote
0answers
58 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
1
vote
3answers
991 views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
0
votes
1answer
382 views

Hash the signing key of an authentication token in database

I have clients which are all browsers. All clients render just a single page application getting data from a Web API. The design of the API follows REST principles. I use token-based authentication ...
-1
votes
1answer
149 views

Is my hashing technique secure? [duplicate]

I am not sure if this is the best place to post this type of question. I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong). Here's the ...
0
votes
2answers
135 views

Any reason to use bcrypt, pbkdf2, scrpt for other things than passwords? [closed]

Let's say I want to hash some data, using SHA256, in order to prove I know something. Maybe it's my secret ID for something. In the real of passwords we have moved from hashing -> hashing+salt -> cpu ...
5
votes
3answers
509 views

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
0
votes
1answer
497 views

About password_hash() in PHP and storing (part of) its salt outside DB

So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is ...
3
votes
2answers
156 views

Hashes of overlapping data - does it make them easier to crack even when neither is cracked

Say I have strings: stringA, StringB, stringC. And I make two hashes: HashA = sha256(stringA + stringB) HashB = sha256(stringB + stringC) For the sake of the argument I'm suggesting sha256 but ...
2
votes
1answer
514 views

New to security, is php password_hash() good enough?

This is the first time I've had to handle personnel information and I want to make sure I have a good amount of security. I will be storing users' emails and passwords for their accounts on a MySQL ...
9
votes
1answer
185 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...