Reputation
874
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 11 24
Impact
~63k people reached

  • 0 posts edited
  • 0 helpful flags
  • 21 votes cast
Aug
9
asked Does truncating the cryptographic hash make it impossible to crack?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
Yes all input will have to go through hash() first before md5(). On another note, I guess it goes without saying that in case the attacker obtained the database of hashes, the md5() wrapping actually makes his job one step harder right vs just hash() alone ?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
Thank you for the thorough explanation. Just to confirm in layman's term, do you agree that there is no problem in $hash = md5(hash($password,$salt,$rounds)); for as long as hash() internally uses a strong algo like bcrypt ?
Aug
9
revised Is it okay to wrap a cryptographic hash with MD5 for storage?
added 382 characters in body
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
@Piskvor I already told you that.
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
@Piskvor It's not really about shortage of space, it's just that if it actually helps or doesn't affect security then why not, besides, they look clean in short hashed form.
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
@Polynomial I guess it's safe to say wrapping scrypt or bcrypt or pbkdf2 to a fixed length hash weakens them?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
Isn't this method quite collision prone?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
So I guess the only problem of this is collision. What if I use SHA256 instead for a wrapper? For example, which is stronger in this case: A PBKDF2 hash with 64 bytes output... or a PBKDF2 hash with 256 bytes output then wrapped with SHA256 for a 64 bytes final output?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
@TerryChia Yes that's what I meant.
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
If they crack the md5 hash what they get is another hash made with bcrypt for example.
Aug
9
asked Is it okay to wrap a cryptographic hash with MD5 for storage?
Aug
8
accepted Securely tell the user his password in new WHM/Cpanel account creation?
Aug
3
accepted Are my credentials unsafe if I am already logged-in before connecting to a public network?
Aug
3
asked Securely tell the user his password in new WHM/Cpanel account creation?
Aug
3
comment What was done to gain a list of home directory accounts?
@schroeder I see but aren't those commands accessible to root only? Do you think a file hosted on a shared cpanel account can actually run this?
Aug
2
asked Can /etc/passwd file be accessed on a cpanel shared hosting account?
Aug
2
comment What was done to gain a list of home directory accounts?
@symcbean Do you mean a PHP or Perl script can get all the data as presented in the text file?
Aug
2
comment What was done to gain a list of home directory accounts?
The video you posted is not WHM/Cpanel, that is a different product called WHMCS.
Aug
2
asked What was done to gain a list of home directory accounts?