170 reputation
5
bio website
location
age
visits member for 2 years, 5 months
seen Sep 14 '12 at 18:12

Mar
1
awarded  Editor
Mar
1
revised Password security in databases - today still best practice?
deleted 395 characters in body
Mar
1
comment Password security in databases - today still best practice?
You're right. Editing answer.
Feb
29
awarded  Teacher
Feb
29
awarded  Commentator
Feb
29
comment Password security in databases - today still best practice?
"but you can use SHA-2 right now safely and later SHA-3." - LATER. I said LATER. And 5000 iterations is WAY too much. 1-2-3 is perfectly enough.
Feb
29
comment Password security in databases - today still best practice?
Why the TWO downvotes? What was wrong in my answer?
Feb
29
comment Password security in databases - today still best practice?
Yep, perhaps you're right. I said it's only good to use if for some reason even SHA2 isn't affordable
Feb
29
comment Password security in databases - today still best practice?
Yeah right. And yes, if you decide for usernames, they really should have a minimum length, for example 5 or 7 characters.
Feb
29
comment Password security in databases - today still best practice?
I think that these common usernames like admin, etc. should not be allowed. Also, take the example of paypal: they use email address to login. If it's good for paypal, it is good for you. Why is it not a problem to use them? They can login with expired email address then they can change so they will have a valid one later. But if you wish to use usernames, that's reasonable as well because of what you mentioned but usernames are much more easy to guess than emails: if someone is called "Alice", there's a chance they'll login as alice even if their email is alice.johnson.1980@example.com
Feb
29
comment Password security in databases - today still best practice?
Yes, you store it in the database as cookies can be deleted pretty easily and IPs can be changed with proxies or using dinamic IP providers. And for admin, root, I say you shouldn't even let these to be in the username as they might be misleading to another users (but this isn't related to password security but it's because of the scam possibilities).
Feb
29
comment Password security in databases - today still best practice?
Addition to this: they don't even have to break, just have the info that username of B is "whateveritis" and then they'll try to log in with this with many dictionary-based passwords. And they might be successful. You might do that aftern (3? 5? 10?) tries, it won't let people login, but then B will be angry that they cannot login because a hacker has tried to login and leaves your site and goes to a competitor.
Feb
29
comment Password security in databases - today still best practice?
Chris: not really. Imagine this situation: somehow hacker A breaks into your server, gets to the database and sees your coding. A saves the database to their own server and tries to brute-force password of B. If B's pass is "Benjamin", "78492823", or even "damn16websites", A will break it with simple dictionary attacks. But if it's "60EaD$qőPo", they won't.
Feb
29
comment Password security in databases - today still best practice?
Mostly yes. In the documentation of PHP's hash() function, someone submitted some datas on time. From the commonly used algorithms, MD5 was the fastest (I don't consider MD4 as commonly used), 6890 microseconds, then SHA1 8886 microseconds and SHA256 was 19020 microseconds. (Nearly 3 times as SHA1). Runtime is very important: the next member of MD family, MD6 didn't even get to round 2 of SHA3 competition because of runtime. Sources: php.net/manual/en/function.hash.php and csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html
Feb
29
comment Password security in databases - today still best practice?
SHA-2 (SHA256 includes this), but even SHA-1 is good for most uses with a good salt. If you use good salt and SHA-2 family, you could be sure of safety if your users use good passwords.
Feb
29
answered Password security in databases - today still best practice?
Feb
12
awarded  Scholar
Feb
12
accepted How much security should I use for my web application?
Feb
12
comment How much security should I use for my web application?
Thanks. I know the kiddie-possibility is high, but is it for all kind of known vulnerabilities that have a tool, or just the 2-3 most basic ones (XSS, SQL injections), or 5-10 (session hijacking, authentication management problems)?
Feb
12
asked How much security should I use for my web application?