Reputation
2,962
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
1 11 19
Newest
 Yearling
Impact
~223k people reached

  • 0 posts edited
  • 0 helpful flags
  • 283 votes cast
Oct
23
awarded  Guru
Oct
23
awarded  Mortarboard
Oct
23
awarded  Good Answer
Oct
22
awarded  Nice Answer
Oct
22
answered Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?
Aug
14
comment Hashing Algorithms Costs vs Sleep
Your first point is incorrect, if the hash algorithm is slow, this will thwart offline brute-force attacks. The slowness has to come from the necessary cpu time and not from a sleep() that can be circumvented though. That's why one should use a slow hash algorithm with a cost factor.
Aug
14
answered Hashing Algorithms Costs vs Sleep
Jul
25
awarded  Constituent
Jul
24
awarded  Caucus
Jun
9
answered How secure is it to keep the salt with the password hash?
May
22
comment Please help verify my understanding of Domain Validation (DV) SSL Certificate
@Pacerier - The prices vary very much and are dependend of your country. I can only speak for switzerland, there you can buy a domain validated certificate for about 50$ per year, and you get an ev certificate for 300-1200$ per year.
May
11
awarded  Nice Answer
May
11
comment Store password using sha1
@LoganWayne - I assume that your question targets the password_hash() function. Yes you can either use no parameters, or a cost factor alone, it is not a good idea to pass a salt though, because the function already generates a safe one. Added an example in the answer.
May
11
revised Store password using sha1
Added an example with cost factor
May
11
comment Store password using sha1
@LoganWayne - Yes that is what i would recommend, it is implemented in fast native code in PHP 5.5 and later, but there also exists a compatibility pack for earlier versions.
May
11
comment Store password using sha1
@LoganWayne - I would suggest to use the password_hash() function instead, it generates a BCrypt hash which is difficult to use on GPUs. And btw. it is also much easier, it takes care of generating a safe salt and is future proof.
May
11
revised Store password using sha1
added 1 character in body
May
11
answered Store password using sha1
Apr
27
comment Should password reset tokens be hashed when stored in a database?
@IanWarburton - I do not have a facebook account, so i cannot verify how they solved the password reset function.
Apr
27
comment Should password reset tokens be hashed when stored in a database?
@IanWarburton - A six digit number has not nearly enough entropy to be used as a token, so it is not safe to store its hash in the database. A salt won't help neither, because the salt is known and a million possibilities can be brute-forced in a fraction of a second. If you take the code as a password, you would have to use a slow salted key-derivation function at least.