Tagged Questions

0
votes
3answers
102 views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
18
votes
5answers
1k views

What is the point of hashing passwords?

Even when following strict security protocols, and what the user typed is (in this hypothetical situation) completely impossible to derive, the key that the server needs to compare to is still there. ...
2
votes
2answers
346 views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
17
votes
7answers
2k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
14
votes
6answers
743 views

Hash function change

I have user account passwords stored in a database using an unsafe (old) cryptographic hash function. What is the best/usual approach to changing password hash function? Only two ideas come to my ...
1
vote
3answers
171 views

For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?

I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
3
votes
1answer
153 views

How should I store a password to allow people to enter single characters from it? [duplicate]

Possible Duplicate: How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext? Some banking applications ask for random letters ...
7
votes
2answers
386 views

Is there more to password hashing?

You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
5
votes
2answers
139 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
4
votes
3answers
359 views

Trying to understand password hashing

I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
10
votes
3answers
457 views

Does the salt need to be unique or not predictable?

I always thought that salts is simply used to prevent rainbow tables to be used. Other have suggest they should be unique on a per account basis. Currently i have been using a config file to use as ...
15
votes
7answers
384 views

To salt, or not to salt? [duplicate]

Possible Duplicate: Why is using salt more secure? Why would salt not have prevented LinkedIn passwords from getting cracked? Recently I decided that I wanted to learn more about web ...
-2
votes
1answer
197 views

What encryption hash function I should use for password securing? [duplicate]

Possible Duplicate: How to securely hash passwords? What is the best encryption algorithm? MD5, SHA1, SHA2 or maybe something else? Can you explain me why?
25
votes
8answers
2k views

Why would salt not have prevented LinkedIn passwords from getting cracked?

In this interview posted on Krebs on Security, this question was asked and answered: BK: I’ve heard people say, you know this probably would not have happened if LinkedIn and others had salted ...
18
votes
5answers
711 views

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them ...
7
votes
4answers
1k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
4
votes
3answers
434 views

Hashing length for storing password

Does larger hash size improve the security? Is it overkill to use 512 bit hash? If I stored only 256 bits of the PBKDF2-SHA512 derived key, is it less, equal or more safe than 256 bits of ...
4
votes
11answers
3k views

Definitely safest password storage scheme?

I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it. Believe, I know, there are hundreds ...
8
votes
2answers
1k views

How big salt should be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
7
votes
2answers
541 views

How does Google not care about “spaces” in Application-specific passwords?

I have recently setup "2-step verification" for my Google account. One of the features is the ability to create "Application-specific passwords " for devices that do not support the 2 step process. ...
5
votes
2answers
573 views

Keeping user data private in a cloud environment like Google App Engine

I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
3
votes
5answers
332 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
33
votes
7answers
2k views

“Real” Salt and “Fake” Salt

During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
19
votes
3answers
811 views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
6
votes
2answers
472 views

Is it better to hash n*x times in sha1 or n times in sha512 on the client side?

I already know I"m going to hash the user's password n times in either sha512 or n*x in sha1 before it is sent to the server. Once at the server, I'm going to use bcrypt set to use ~1/100th of a ...