Tag Info

New answers tagged

1

You get different values because different salts are used. The salt is the second field in the hashed password. There exist large rainbow tables that make the lookup of hashes of common passwords very cheap. The point of salt is to dramatically increase the cost of precalculating hashes for all commonly used passwords. So salt basically makes a password ...


1

Since you are talking about Unix, and since you are rather talking about /etc/passwd file instead of /etc/shadaw, I presume you are talking either about a Unix system (as you said) or an old based distribution, so I prefer to quote you this directly as it answers your question: Earlier versions of Unix used a password file (/etc/passwd) to store the ...


5

On most modern distributions, the salts and the hashed passwords are stored in the shadow file /etc/shadow (which is only readable by root), not the /etc/passwd file. For each user record in /etc/shadow, the salt is between the 2nd $ and the third $. See answer by mti2935 in ...


2

As Martin suggested in the comments, I would highly suggest using TLS. Even if your audience is young teens, disclosing the salt to the client is not a good idea. For example, what would happen if the salt for the hashes is hard-coded into your web application and an attacker exploits a vulnerability to extract the bcrypt password hashes? If the attacker ...


0

Most modern encryption algorithms are designed such that the ciphertext is indistinguishable from random noise. But if an older algorithm was used, it may be possible to glean some information about the algorithm from the ciphertext. See this post on Cryptography SE for more info.


2

Whenever you have a human password and want to process it into some format that "leaves traces", then you need to do it with a function that is resilient to brute force (e.g. PBKDF2). You thus need to do that when you hash the password to obtain a password verification token that you store; you also need to do that when you are turning the password into a ...



Top 50 recent answers are included