Timeline for Why are only passwords hashed?
Current License: CC BY-SA 3.0
35 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 23, 2019 at 13:10 | vote | accept | Aman Kothari | ||
| Nov 1, 2016 at 9:14 | comment | added | Ian Ringrose | For the same reason, it is often best to pay another company to store the credit details of your customers, so you only store the “token”, hence are not responsibly if the card details get out. | |
| Nov 1, 2016 at 9:13 | comment | added | Ian Ringrose | Think of someone stealing the backup type of the database and the fact that a lot of your users will have the same password on your system as they do on their bank…… | |
| Nov 1, 2016 at 8:28 | comment | added | duongntbk | @Random832 Yes it is more than enough, unless we have some fundamental new discoveries in math and/or physics. But I think we have side tracked far enough. If you want a details calculation then perhaps we can take this conversation to chat? | |
| Nov 1, 2016 at 6:02 | comment | added | Random832 | @tsukumogami The question is whether it's enough orders of magnitude for it to still be a lower chance to get a collision on $2 worth of server time vs winning the powerball on one ticket. | |
| Nov 1, 2016 at 0:51 | comment | added | duongntbk | @dan04 If your hash does not have any known weakness, then it does not matter if you can calculate a million or a billion hashes per second, the chance to find a collision is still much much lower than the chance to win the power ball, by many orders of magnitude. | |
| Oct 31, 2016 at 23:54 | comment | added | Criticizing Israel not allowed | If you hashed the user's bank balance how would the computer know their bank balance? Does the user have to type in their bank balance and then have the computer check it? | |
| Oct 31, 2016 at 19:03 | comment | added | Alexander | I would like to address the underlying misconception here: hashing isn't to protect you. Your database is compromised, and likely other systems with it. Too late for you. Hashing passwords is done to protect your USERS, because they likely use the same passwords across multiple sites. | |
| Oct 31, 2016 at 15:49 | comment | added | dan04 | @tsukumogami: Yes, but with readily-available computing hardware, I can calculate a million hashes per second. I can't buy Powerball tickets that fast because I'm limited by the $2 purchase price. | |
| Oct 31, 2016 at 8:50 | history | protected | Rory Alsop♦ | ||
| Oct 31, 2016 at 4:56 | answer | added | Nick Gammon | timeline score: 5 | |
| Oct 31, 2016 at 2:29 | answer | added | Michael Green | timeline score: 2 | |
| Oct 31, 2016 at 2:08 | comment | added | parker.sikand | "Is hacking the database that easy?". No. The hacking occurs in the many layers of people and systems in between the hacker and the database. Your fancy vault door is useless if the guard will give anyone the key. | |
| Oct 30, 2016 at 22:41 | comment | added | jwodder | @Damon: See Why don't people hash and salt usernames before storing them | |
| Oct 30, 2016 at 18:38 | answer | added | Tomas Kubes | timeline score: -2 | |
| Oct 30, 2016 at 16:21 | comment | added | Damon | This question got me thinking: Actually usernames are a kind of "valuable information", too (users are likely to use the same username on different services, so matching a cracked password with another service is easier knowing the user name). Insofar, this is a valid thing to wonder, and hashing usernames might indeed be worthwhile. Only... how to prevent collsions? Usernames must be unique, and while unlikely, hash collisions on different usernames are possible... | |
| Oct 30, 2016 at 1:20 | comment | added | ceejayoz | @tsukumogami Yeah, but OP mentions MD5 and SHA1. So, I'm a budding multi-quintillionaire! | |
| Oct 30, 2016 at 1:11 | comment | added | duongntbk | @ceejayoz you are much more likely to win the lottery than to find a numeric collision of your balance, if the hash does not have any known collision resistance weakness. | |
| Oct 29, 2016 at 23:42 | comment | added | ceejayoz | I really wish my bank would hash my balance. I'd find a stupidly-high numeric collision for the hash and buy the world. | |
| Oct 29, 2016 at 23:05 | answer | added | AnoE | timeline score: 2 | |
| Oct 29, 2016 at 13:01 | answer | added | djechlin | timeline score: 2 | |
| Oct 29, 2016 at 11:19 | review | Close votes | |||
| Oct 30, 2016 at 5:14 | |||||
| Oct 29, 2016 at 11:01 | comment | added | Philipp | Possible duplicate of How to securely hash passwords? | |
| Oct 29, 2016 at 10:35 | answer | added | H. Idden | timeline score: 5 | |
| Oct 29, 2016 at 3:08 | answer | added | Arjun sharma | timeline score: 0 | |
| Oct 29, 2016 at 1:32 | comment | added | slebetman | A lot of times hackers don't actually manage to "hack into the database", that is, hackers don't manage to get access to the database. Instead they just manage to dump the database. So they can't change it but can get the hashed passwords. So they "why would he want the hash" is because that's what he gets. From there he would want to try to reverse the hash using rainbow tables etc to get at least a few passwords that match some of the hashes. Then he can login. Note that he would almost NEVER be able to get all the passwords. Only some. But then he would be able to login. | |
| Oct 28, 2016 at 23:48 | comment | added | jpmc26 | You have a misunderstanding about what MD5 is unsafe. See here. It's about speed, not published results. (The latter can be overcome with a long, random salt.) SHA-1 suffers from the same problem. | |
| Oct 28, 2016 at 23:45 | history | tweeted | twitter.com/StackSecurity/status/792150350987952128 | ||
| Oct 28, 2016 at 22:59 | answer | added | paj28 | timeline score: 8 | |
| Oct 28, 2016 at 22:52 | history | edited | Xander |
better tags
|
|
| Oct 28, 2016 at 22:48 | answer | added | Xander | timeline score: 22 | |
| Oct 28, 2016 at 22:44 | answer | added | deviantfan | timeline score: 60 | |
| Oct 28, 2016 at 22:42 | answer | added | Gabor Lengyel | timeline score: 8 | |
| Oct 28, 2016 at 22:34 | history | migrated | from crypto.stackexchange.com (revisions) | ||
| Oct 28, 2016 at 21:26 | history | asked | Aman Kothari | CC BY-SA 3.0 |