IMB

572 reputation

415

bio	website
	location
	age
visits	member for	1 year
	seen	May 16 at 16:39
stats	profile views	33

	572 reputation	bio	website		visits	member for	1 year
415 badges		location			seen	May 16 at 16:39

summary answers questions tags badges favorites bounties reputation activity

132 Actions

suggestions reviews revisions comments badges posts accepts all

Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? Yes all input will have to go through `hash()` first before `md5()`. On another note, I guess it goes without saying that in case the attacker obtained the database of hashes, the `md5()` wrapping actually makes his job one step harder right vs just `hash()` alone ?
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? Thank you for the thorough explanation. Just to confirm in layman's term, do you agree that there is no problem in `$hash = md5(hash($password,$salt,$rounds));` for as long as `hash()` internally uses a strong algo like `bcrypt` ?
Aug 9	revised	Is it okay to wrap a cryptographic hash with MD5 for storage? added 382 characters in body
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? @Piskvor I already told you that.
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? @Piskvor It's not really about shortage of space, it's just that if it actually helps or doesn't affect security then why not, besides, they look clean in short hashed form.
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? @Polynomial I guess it's safe to say wrapping `scrypt` or `bcrypt` or `pbkdf2` to a fixed length hash weakens them?
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? Isn't this method quite collision prone?
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? So I guess the only problem of this is collision. What if I use SHA256 instead for a wrapper? For example, which is stronger in this case: A PBKDF2 hash with 64 bytes output... or a PBKDF2 hash with 256 bytes output then wrapped with SHA256 for a 64 bytes final output?
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? @TerryChia Yes that's what I meant.
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? If they crack the md5 hash what they get is another hash made with `bcrypt` for example.
Aug 9	asked	Is it okay to wrap a cryptographic hash with MD5 for storage?
Aug 8	accepted	Securely tell the user his password in new WHM/Cpanel account creation?
Aug 3	accepted	Are my credentials unsafe if I am already logged-in before connecting to a public network?
Aug 3	asked	Securely tell the user his password in new WHM/Cpanel account creation?
Aug 3	comment	What was done to gain a list of home directory accounts? @schroeder I see but aren't those commands accessible to root only? Do you think a file hosted on a shared cpanel account can actually run this?
Aug 2	asked	Can /etc/passwd file be accessed on a cpanel shared hosting account?
Aug 2	comment	What was done to gain a list of home directory accounts? @symcbean Do you mean a PHP or Perl script can get all the data as presented in the text file?
Aug 2	comment	What was done to gain a list of home directory accounts? The video you posted is not WHM/Cpanel, that is a different product called WHMCS.
Aug 2	asked	What was done to gain a list of home directory accounts?
Jun 19	comment	Are my credentials unsafe if I am already logged-in before connecting to a public network? Is HTTPS is still considered safe? I just read about "SSL Strip" and it seems SSL is no longer safe.