150 reputation
5
bio website ich-wars-nicht.ch
location Switzerland
age 23
visits member for 2 years, 2 months
seen Jun 30 at 9:17

I'm a computer science student and software developer from Switzerland. I especially enjoy working with Python and Django.

I usually post my OSS Code at https://github.com/gwrtheyrn.


Sep
10
comment Finding out whether a website uses unsalted MD5 for password hashing
Great and comprehensive answer, thanks a lot! :)
Sep
10
accepted Finding out whether a website uses unsalted MD5 for password hashing
Sep
10
comment Finding out whether a website uses unsalted MD5 for password hashing
If you have access to the database it's obvious of course :) I don't. (I did not specify that in my question though, sorry...) Regarding to MD5 / cryptographic hashes in general, I'm talking about MD5 because it's the most widespread one while at the same time being very weak with many known collisions. So it should be detectable using collisions. I'm aware that SHA1 and other widely used hash functions are also insecure and that they should never be used for password hashing.
Sep
10
comment Finding out whether a website uses unsalted MD5 for password hashing
@LucasKauffman Of course, but salted hashes cannot be detected via collision, without knowing the salt :) I'm just trying to get all the information I can.
Sep
10
asked Finding out whether a website uses unsalted MD5 for password hashing
Jun
4
accepted HMAC Based Request Signing - Storing the Salt
Jun
4
awarded  Supporter
May
22
awarded  Scholar
May
18
comment HMAC Based Request Signing - Storing the Salt
Apparently the salt isn't just a 16 byte string: stackoverflow.com/questions/8869367/… I ended up using "$2$10$" + sha256val.substring(0,22) for the moment.
May
17
comment HMAC Based Request Signing - Storing the Salt
Thanks. I didn't know about the 16 byte requirement. In that case, a MD5 of the username should be sufficiently secure to prevent rainbow table attacks. Even though that would be probably still more common than stuff like repeating the username several times and using the first 16 characters of that string...
May
17
revised HMAC Based Request Signing - Storing the Salt
bcrypt expects 16 byte salt
May
17
comment HMAC Based Request Signing - Storing the Salt
The salt is encoded in the bcrypt string, yes. But the problem is that that string is only stored on the server side. If the user buys a new smartphone, he enters his password in it, and then a hash has to be calculated from that password that matches the one stored on the server.
May
17
awarded  Student
May
17
awarded  Editor
May
17
revised HMAC Based Request Signing - Storing the Salt
added 31 characters in body
May
17
asked HMAC Based Request Signing - Storing the Salt
May
17
awarded  Autobiographer