Tag Info

New answers tagged

3

I think many of your questions (eg SHA-512 vs bcrypt) are answered in the guide linked to by AviD. But it doesn't actually say anything about PHP, so I'll answer that part. Hashing a Password in PHP5 It's good that you want to understand the underlying concepts, but actually securely hashing a password in PHP5 is quite easy: $hashedPassword = ...


2

As documented rather indirectly in the page for the crypt() function, the "cost" parameter is the base-2 logarithm of iteration count, or to put it another way, each +1 increase to "cost" represents a doubling of the number of iterations. If a cost-10 hash takes one minute to crack, a cost-14 would take 2^(14-10) = 16 minutes. Cracking a cryptographic has ...


2

Well Dmitry is right when he says 72 characters is good. If the characters are random enough. (1.78 bits per character). You can use the approach described (security warning that password is "too long"). Or simply limit password length (with security warning). If you expect your users to enter more than 72 characters, you could as well use SHA-512 to ...


0

I wouldn't worry about it. 72 characters is a quite decent password length, and password truncation is a common practice. Your users will trust you with many security options (like hash algorithm and the number of iterations) which affect security much more than password length. Implementing a warning wouldn't hurt though, that is, if you have nothing else ...


0

I didn't implement such a system. But I can still answer your questions (I hope). A different password for each application is a nice feature to enhance security, so that a broken password won't immediatly give you access to all apps. The problem with logging in with a different password for each application is the amount of passwords. Google has like 10 ...



Top 50 recent answers are included