A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

-8
votes
1answer
194 views

Someone help me decode this [closed]

What type of hash is this? a9df6dcd35f4e7223ff3dd087abcc266 I can't find anything when I decrypt it. Please someone decrypt it
2
votes
1answer
339 views

How Windows Server 2008 Stores Local Users Passwords?

It is not clear to me how Windows Srver 2008 R8 stores local account passwords. Is there any salt added or just NT hash is computed and stored. The following article describes all the methods used by ...
2
votes
1answer
260 views

HMAC secret key for securing communication - how to keep private on DB

I have a mobile app that communicates to server over HTTPS. To authenticate the client and to make sure its who I believe it is, I return upon successful signup (apart from the username) a secret API ...
9
votes
2answers
2k views

How does Google not care about “spaces” in Application-specific passwords?

I have recently setup "2-step verification" for my Google account. One of the features is the ability to create "Application-specific passwords " for devices that do not support the 2 step process. ...
1
vote
2answers
212 views

Why is the brute force search time for hashing algorithms 2^(num_bits / 2)?

I noticed that the brute force times (the time it takes to find a message that hashes to a given hash) of various hashing algorithms seems to be 2^(num_bits / 2). For example, people say that brute ...
1
vote
3answers
182 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
44
votes
8answers
6k views

Do bad passwords produce bad salted hashes?

When you have a password stored in a database that has been strongly hashed and salted does it really matter if the underlying user password is weak? If you setup features like limiting login ...
3
votes
2answers
136 views

Similarity comparisons with hashed passwords possible?

At a company I worked at, I had to change my password every 90 days and I could only reuse a password after 8 iterations. This no-reusal included passwords being too similar to the old one, e.g. when ...
9
votes
6answers
1k views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
3
votes
1answer
383 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
1
vote
1answer
66 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
-2
votes
2answers
80 views

Strength of WPA passwords

How long would it take to crack an 8 letter (latin alphabet, lowercase) password of a WPA PSK network? Is it in reach of a single PC running hashCat?
20
votes
9answers
1k views

Is a simple, but very long password a good password?

Is a password like wwwwwwwwwwwwwwwwwwwwwwwww9 (25x 'w' and a number) secure? It would be easy to remember.
0
votes
2answers
157 views

Are there any good tools to test the encryption quality of data?

I am trying to increase my understanding of data encryption, and I was wondering this. It would be really nice if there were any good tools to test how secure my encrypted data is, for example how ...
-4
votes
1answer
204 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
0
votes
2answers
66 views

What is the solution for handling exceptions in password hashing schemes?

There is a technique called password hashing that describes creating unique passwords based on a unique master key and a static and arbitrary hash value. Using this technique, the user only has to ...
1
vote
0answers
175 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
3
votes
1answer
116 views

How to best to secure data over HTTPS

My aim is to have an (iOS) app in which the user would login, then on sucsessful login, gain access to additional information over an encrypted webservice (undecided). From research, I understanding ...
8
votes
5answers
2k views

Should I remotely store my salt? [duplicate]

When users register on my site, I want to store their username and hashed password in my database. When I hash that password, I'm going to salt it using PHP. The issue is, I don't want to store the ...
0
votes
3answers
74 views

How SplashData knows about Worst Passwords used by users annually

It is known that every reputable website stores their user passwords into their database after implementing some hashing algorithm on it, and even they don't know what the actual password of the user ...
0
votes
1answer
133 views

Identify an unknown type of hash [closed]

I've come across an unknown type of hash value which looks like this: AAAAAATOM2KIII+kbR/Dqw3TLTw4PHsGPZft2c+b93rImFIuAQ== The corresponding hex string is: ...
1
vote
1answer
59 views

truncated hash for message authentication?

I am using hash for authenticating the signature of the message. since the hash will be part of a url that is used for QR code, I would like to keep the hash as short as possible in order to generate ...
1
vote
2answers
171 views

Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?

I'm helping my friend with hashing his passwords, and I've a question - Should he use one secret string as salt for hashing or is it better to have each user its own salt for hashing? Consider these ...
-2
votes
1answer
136 views

What is “Pass the hash” attack?

The article on Wikipedia doesn't explain how the attacker can authenticate to the remote server using the hash instead of the original password. According to the following article the attack is still ...
3
votes
2answers
246 views

Is it unsafe to have hashes of parts of a private string

We have string B and the hashes hash(P+B), hash(P); is it possible for P to be revealed easier using this information than having hash(P) ? What is the difference ? Any links to articles or any ...
-2
votes
3answers
255 views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
2
votes
2answers
133 views

Difference between Second Pre-image Resistance and Collision Resistance in Cryptographic Hash Functions

I am studying the subject from these notes. However it is not clear what is the difference between "Second Pre-image Resistance" and "Collision Resistance" properties of Cryptographic Hash Functions. ...
2
votes
1answer
84 views

Security of shared “super pin” code table at meineschufa.de

The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and ...
28
votes
5answers
12k views

Why AES is not used for secure hashing, instead of SHA-x?

As far as I understand, AES is believed to be extremely secure. (I have read somewhere that it would certainly not be broken in the next 20 years, but I am still not sure if the author was serious.) ...
1
vote
0answers
101 views

Breaking it gently

Let's say I've found a fundamental error with mathematics of a security package. For example, let's say I've found something similar to the Pollard’s \rho-1 algorithm that renders some of the RSA keys ...
3
votes
1answer
169 views

Windows system password hashed - see which hash is used

How can I know / see if my windows is using NTML, LM, NTML2 for its user account passwords? What is the standard today, in windows systems?
14
votes
5answers
4k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
14
votes
3answers
2k views

Content hashes to help protect resources being fetched from a CDN

During a conversation in The DMZ, it was suggested that an SHA256 hash could be used to check that content being delivered from a CDN hasn't changed before being executed, similar to how Kim Dotcom's ...
1
vote
1answer
91 views

Can a known MD5 hash limit the search space for SHA1 collisions?

For a course in game theory, we are dealing with BitTorrent and alternative strategies (roughly alternative clients) we can employ to maximize our download speed. One strategy is to over-report the ...
3
votes
3answers
530 views

Accepting other similar passwords when storing a salted, hashed password

If a website stores passwords as a salted hash, is it reasonable to accept similar passwords as correct? For example, given the password stackexchange, does it dramatically decrease security if the ...
7
votes
2answers
658 views

Does Outlook store plain-text passwords?

A long time ago when Microsoft changed my e-Mail from Hotmail to Outlook the password-interface said that I should only put in the first 16 chars of my password. But my password was longer before. So ...
0
votes
1answer
146 views

How to decode/decrypt strings of text [closed]

So I'm trying to decrypt/decode some text strings. I don't believe they're hashes because they vary in length too much and the software they are used for is able to easily decode them and display them ...
1
vote
1answer
155 views

Adding hash value to user supplied URL in a web application: any security benefit?

We administer a Java web application from an external supplier where we have access to the source code. The user is able to provide an external URL which is stored in a database and later on embedded ...
0
votes
3answers
165 views

Is is necessary to encrypt the message digest?

In symmetric key settings, in order to provide the message integrity, we compute the hash of the message. The message along with the message digest is then encrypted. Is it necessary to encrypt the ...
13
votes
2answers
662 views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
0
votes
1answer
3k views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
1
vote
2answers
156 views

Search on hashed data

We have a request to encrypt customer personal data (e-mail, address etc.) We use MySQL which does not have any TDE like MS SQL or Oracle. So along with encrypting data we need to preserve ...
0
votes
3answers
7k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
2
votes
3answers
167 views

Is it ever safe to publish hashed data?

I'm having a friendly debate with someone who thinks that a website can safely make public sensitive data about it's users as long as that data is hashed (don't ask why, it's a long and hypothetical ...
0
votes
2answers
65 views

Protect against malicious client with key derivation function (PBKDF2)?

Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and ...
3
votes
2answers
307 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
0
votes
1answer
85 views

Secure log in without sending plain test to server

I know this question asked so many times, but here I am again with it. I am working on an application in which I need to log-in users but the question is it is not a good Idea to send user credentials ...
4
votes
2answers
246 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
7
votes
4answers
1k views

Why secure encrypted data consistency by strong hashing?

Consider the SSH protocol: the SSH packet is like [data, SHA1(data)]. The packet is entirely encrypted by a block cipher. The question is, why do we need a strong hash to protect the packet ...