1,307 reputation
1412
bio website martinstoeckli.ch
location Switzerland
age 41
visits member for 2 years, 1 month
seen 23 hours ago

I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working more and more with CSharp and use PHP for my spare time project, an internet lost-and-found office.

// Don't tell people not do something, explain the reasons and let them think for themselves.


Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy - You already answered it well. The hash is used to make it impossible to retrieve the original password, so storing the password as salt in a retrievable form will undo the whole effort (you need it for verification). If you want to add a server side secret, a good method is, to encrypt the password-hash with a server side key, or to use a pepper. But don't mix up the two, let the salt be known (plaintext) and the server-side key be a secret.
Sep
1
comment Do salts have to be random, or just unique and unknown?
Calling a hash like sha-256 will not generate any entrophy at all. The number of possible inputs will fix the number of possible hash-values.
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy - To double the password would help nothing at all, this would be just another hash algorithm. It would not even add a server side secret (the algorithm), since the salt is normally stored plaintext. You could then build 1 rainbowtable to recover all passwords of your database.
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy - It doesn't matter, whether a user has the same id on another site, a rainbow-table with those salts would contain "all" passwords with all of the choosen salts, thus working for every site. About the email, you cannot presume that the emails are hidden from the public, hashes are made or the case, when the database is already stolen, so the email addresses will be known as well. Using the email as salt, maybe combined with other data and hashed, is not the worst thing you can do, but using a random independend salt is always better.
Sep
1
comment Do salts have to be random, or just unique and unknown?
@IlmariKaronen - Just wrote a bit more clear what i meant (about the middle part), probably you didn't notice the edit. And of course key-stretching is a must today.
Sep
1
revised Do salts have to be random, or just unique and unknown?
deleted 107 characters in body
Sep
1
revised Do salts have to be random, or just unique and unknown?
added 5 characters in body
Sep
1
revised Do salts have to be random, or just unique and unknown?
Justification about salt thwarting brute-force attacks.
Sep
1
revised Do salts have to be random, or just unique and unknown?
added 96 characters in body
Sep
1
answered Do salts have to be random, or just unique and unknown?
Aug
29
revised Why is password hashing considered so important?
Thanks TRiG for your corrections (english isn't my native language), but this point is necessary.
Aug
29
awarded  Custodian
Aug
29
reviewed Approve suggested edit on Why is password hashing considered so important?
Aug
29
answered Why is password hashing considered so important?
Aug
27
answered Please help verify my understanding of Domain Validation (DV) SSL Certificate
Aug
23
comment 419 Nigerian scam problem
@eternalidiot - Macs are handling the file type separately as far as i know. If opening this pictures is the only thing you did, i wouldn't worry too much about your computer. Opening pictures is what a browser does all the time.
Aug
23
comment 419 Nigerian scam problem
@eternalidiot - So then you could check, whether they are real pictures you opened. On Windows systems, the file extension is important, normal pictures have an ending like filename.jpg or filename.png. Executeables have an ending like filename.exe but can try to hide this with filename.jpg.exe, because Windows will hide the last part. I don't know how experienced you are, but this is a check i would do, it is very unlikely that real pictures are harmful.
Aug
23
comment 419 Nigerian scam problem
@eternalidiot - Why do you think your computer could be compromised? There are two ways to become infected, either you opened an email attachement, or you clicked a link they sent to you. Did you do either of them?
Aug
23
comment 419 Nigerian scam problem
Which password(s) did you gave them? What type of other information do they have, beside your e-mail address?
Aug
17
comment How long would it take to brute force the AES encryption?
There are quite a lot of problems with this code. You should have a look at PHP's new password api password_hash(), there exists also a compatibility pack for earlier PHP versions. If you want more in-depth information, you may be interested in my tutorial about storing passwords.