1,596 reputation
721
bio website brendanlong.com
location Colorado
age 26
visits member for 3 years, 7 months
seen 8 hours ago

Nov
5
awarded  Popular Question
Jul
30
awarded  Nice Question
Apr
7
awarded  Yearling
Mar
26
comment When and where do I hash a password?
@jhoyla Ah I see. It seems easier to just hash it one more time on the server side.
Mar
26
comment When and where do I hash a password?
The way to make it work is this: The client sends the server the user name, the server responds with a salt and number of iterations / difficulty. The client hashes the password given that information and sends it to the server. The server then hashes it one more time, then validates it against what it has stored. I'm not claiming there's no downsides, they are: (1) the server gives away the fact that the user name is valid (most websites do this anyway though) (2) there's an extra round-trip to request the salt and (3) this doesn't work for all clients (pointless in JavaScript for example).
Mar
26
comment When and where do I hash a password?
Hey don't turn this into a strawman. My argument was specific: There's no reason to hide the hash function or salt. I agree with you that JavaScript cryptography is pointless, but the question was about client-side hashing in general, and not all clients are JavaScript.
Mar
26
comment When and where do I hash a password?
It doesn't matter. The hash function can be public and it won't hurt your security at all.
Mar
26
comment When and where do I hash a password?
I'm not arguing against double hashing. I'm saying lowering the iterations every time doesn't help at all (because the password is still the same, and the attacker only needs one hash to break it).
Mar
26
comment When and where do I hash a password?
Yes, but the server can hash whatever value it gets (the pre-hashed password) before storing it. Just because the client hashed the password doesn't mean the server can't too.
Mar
25
comment When and where do I hash a password?
I think you're skipping a step though. Allowing the client to hash the password doesn't preclude the server from doing it too.
Mar
25
comment When and where do I hash a password?
In what situation does this improve security? The cases I can think of are: (1) attacker has the plaintext password -> you lose (2) attacker has a hashed password and tries to log in with it -> server rejects it because it wants the plaintext (3) attacker has a hashed password and tries to track it -> re-hashing it on the server side doesn't make this any harder since the attacker only needs one valid password hash.
Mar
25
comment When and where do I hash a password?
Making the hash function and salt public isn't a big deal though. If you know what you're doing, the hash function will be obvious (PBKDF2, bcrypt or scrypt) and the salt is just a random number which is useless by itself.
Mar
25
comment Can I use elliptic curve DSA in a secure message service?
@tylerl Some of us learn best by designing systems and then learning why they're broken. If people shouldn't ask questions about things they don't already understand, then they'd never learn.
Mar
10
awarded  Good Question
Mar
4
comment How can one secure a password/key in source code
This isn't relevant to the kind of passwords they're talking about (keys distributed with the application, not coming from users).
Feb
9
revised Is this a good way to store passwords in a Web Application?
added 7 characters in body
Oct
17
comment Altering passwords before storing
I don't think "salt" is the right term to use here.
Oct
16
awarded  Popular Question
Sep
28
comment Is using a CA more secure if I'm self-signing anyway?
No mention of certificate revocation?
Sep
19
answered Ensure web service only accessed by authorized applications