Tag Info

New answers tagged

4

Could there be some miscommunication between you and the IT department head? As Xander had already pointed out, such a scheme does not work, and I would even add that it is ridiculous. In order to authenticate a user, a database lookup has to be performed on the login email address in order to retrieve the corresponding hash used for comparison: SELECT hash ...


9

As far as I can tell, this scheme doesn't make any sense. As you've noted, you still need to store the plaintext email address for the user, so there isn't any significant security benefit to using the plaintext email and email + password + salt hash vs just using plaintext email and password + salt hash. As I'm sure you've already noted, without the ...


0

Should he use one secret string as salt No. One hard-coded side wide salt does prevent pre-calculated rainbow table attacks, but those are not really a major concern nowadays. The main advantage of using a random salt for each hashed password is that an attacker when bruteforcing has to hash each password with each salt, instead of just hashing once ...


3

The primary characteristic of a salt is that it should be globally unique for each user's password hash. It need not be secret, and a username will certainly not meet the required criteria of uniqueness. A shared secret string (used for all users) is not a salt, but a pepper, and has not been demonstrated to add any security over unsalted passwords, and so ...


5

Even if he was using a salt, it would still be a terrible plan. SHA-512 is a fast hash, so you don't need rainbow tables in order to find passwords, simply testing inputs along with the salt can be done at the rate of hundreds of millions to billions of candidate passwords tested per second. What your friend should do, is read the answers to How to ...


0

He may be technically correct, but it is still bad design. His approach will mean that duplicate passwords will generate the same hash, which can reduce an attacker's cost (if he finds out a plain text password from one user and is also able to get the password hashes, he can see which accounts use the same password). His approach is also dependent on ...


7

How about you take his challenge? Go make a quick rainbow table of common passwords and run it over his database. You're bound to hit something (especially if he doesn't have a password policy). However, this may not work if he has a small database.


5

If someone were to get a hold of this database and try cracking the passwords, would allowing these additional combinations significantly reduce password strength? I would argue that it would not in this specific situation. I highly doubt that they are storing three forms of the hashed password in the database, but rather hashing three different ...


0

The simple answer is not really. The easiest way to achieve this would be to use a .ToLower() before salting and hashing, and the same when password checking. However it is worth spending some time thinking about why you would bother. It isn't the browser doing the capitalisation after all, it is the user. It is no different from using @ instead of A or 3 ...


2

The answer to this question depends on two factors: the attack vector the implementation of allowing different passwords Websites should store passwords not in plain-text or any other form allowing to get the password from the saved value. Therefore usually a irreversible hash-function is used, so that only the hashes of the passwords are compared. Now ...



Top 50 recent answers are included