Tag Info

New answers tagged

2

There are currently three accepted password hashing algorithms (note the difference between encryption and hashing!): pbkdf2 bcrypt scrypt So you can use either of these three. PBKDF2 is the most supported. Storing passwords in a reversible way is considered bad practice.


3

I think many of your questions (eg SHA-512 vs bcrypt) are answered in the guide linked to by AviD. But it doesn't actually say anything about PHP, so I'll answer that part. Hashing a Password in PHP5 It's good that you want to understand the underlying concepts, but actually securely hashing a password in PHP5 is quite easy: $hashedPassword = ...


0

SALT supposed to be not secret => same for all users <=> no SALT at all. You can see good explanation here: Hashing security


1

Yes, if you use the same salt then the same password will result in the same hash. The general idea behind secure password storage lies in maximising the amount of computational work that an adversary will have to perform should they gain access to the stored credentials. The purpose of a salt is to mitigate the value of pre-computed (i.e. no additional ...


9

Yes, there are obvious flaws. Here are some: You can't make hashing slow by introducing simple delays. An attacker doesn't have to evaluate the hash the same way you did; they just need to get the same answer in the end. That means whatever is making the hash slow needs to be a necessary component of the hash -- it must be impossible to compute the hash ...


1

no. it looks like you're using a global constant for the salt. you want it to change per user record. see http://stackoverflow.com/questions/2999197/do-i-need-a-random-salt-once-per-password-or-only-once-per-database also, @coverosgene is right - there's no point in slowing your own hash method down.



Top 50 recent answers are included