New answers tagged

0

The salt has to be stored someplace that's easily accessible given a user ID. That means a database table. The hacker who can get the hashed passwords can get the salts in the same way, often using SQL injection. As others have already written, the salt stops precomputation attacks. There is an approach called a keyed hash in which the hash is generated ...


0

Others have clarified the purpose of Salt, which is to require a separate brute-force process per-user to crack, which would take much longer than a single brute-force process finding matches for every user at once. Salt is not needed to be secret, just unique. A good way to improve on this is to include Pepper, which is secret. Pepper is just some random ...


1

The purpose of salting is, that one cannot build a rainbow table to get several passwords at once. Without salting: An attacker could search the internet for precalculated rainbow-tables and find the passwords with no effort. With a constant salt: The attacker has to build one rainbow-table for this specific salt, and can then get all the passwords with ...


0

You answered your question, just did not saw it. why all people say on SO or Internet anyway that putting the salt in the database is good practice or safe The answer is: if I hack to a database (...) I will take the salt of the first record for example and make a dictionary of all hashes of all english words ( rainbow table ) and then I ...


0

Actually most implementations of algorithms like BCrypt will generate a salt on their own, from the random source of the operating system. This is the best one can do and there is no need to derrive a salt from other parameters. A salt should be globally unique for each password, so an attacker cannot find any precalculated rainbow-tables, and would have to ...


0

The only other solution than asking for a new password is to save the new hash on next login, setting a flag to know it's upgraded (if needed). This approach is as secure as your current login, and based on your question, will improve it. Changing the current hash is pointless as it will not add entropy.


5

Hashing client side Secondly assuming that the connection is compromised because of an MiTM attack. The process of how the leaked hash of the password is created is still unknown because the salt and iterations (based on the pincode) are unknown. In case of a MitM attack (made possible by say incorrect use of TLS) hashing client side will not help you. ...


0

The local hashing will not help against passive MitM if the authentication process is simply sending the hash to the server. The attacker can capture the hash during registration/password change and just send a request with the hash instead of using your web application which computes the hash based on password and pin code. Server side hashing keeps ...


1

To analyze this we need to think carefully about various scenarios that stipulate what knowledge the attacker has, and then reason about what other information they can deduce. Mark Burnett's answer already provides us with one such scenario: if the attacker acquires your password from one of the sites, then they know all but two characters of your password ...


3

What you are talking about is not a salt, it's just a pattern, and one that is highly predictable. Say, for example that your password on Amazon is p@ssw0rd123amazon and your password on Google is p@ssw0rd123google and your password on some small e-commerce site is p@ssw0rd123*sitename*. If someone hacks the e-commerce site and posts all the passwords on ...


2

It's a good idea, as it gives a different password for each site. I wouldn't make the unique part too obvious. In the event one password gets leaked, someone could guess the others. So don't do "passwordSITEname" for example. If it gets leaked, an attacker will try "passwordNEWSITEname". I'm a fan of password managers, and think they should be used by ...


1

The process of judging the security of information stored in a password database is done with the assumption that an adversary (hacker) not only knows which cypher/encryption method you are using, but also that he has stolen a copy of your password database. Knowing those things, the hacker wishes to discover password so he can pretend to be a valid user. ...



Top 50 recent answers are included