Linked Questions

547 votes
11 answers
95k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
nallenscott's user avatar
  • 4,749
43 votes
9 answers
19k views

Is salting a hash really as secure as common knowledge implies?

I'm implementing a salt function for user passwords on my web page, and I'm wondering about some things. A salt is an extension added to a password and then hashed, meaning the password is stored in ...
Thomas Andreè Wang's user avatar
54 votes
4 answers
23k views

Why is using salt more secure?

Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
Jim's user avatar
  • 1,415
47 votes
2 answers
10k views

Are there more modern password hashing methods than bcrypt and scrypt?

This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any "...
Brendan Long's user avatar
  • 2,908
32 votes
3 answers
13k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
Pieter's user avatar
  • 1,339
10 votes
2 answers
10k views

How expensive is it to guess a 15 character password, and should I be worried?

I'm currently using AES encryption (at home) on GNU/Linux (one of LUKS AES-256 variants with xts) and on Windows 7 (Truecrypt) with a 15 characters password (alphanumeric lowercase only plus _). ...
user51166's user avatar
  • 201
14 votes
3 answers
2k views

An alternative to traditional passwords: is there some merit to this idea?

If you've got a website aimed at people that are not necessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
AardvarkSoup's user avatar
6 votes
1 answer
7k views

Why does openssl enc -aes-256-cbc -a -salt increase the file size?

I'm using openssl enc -aes-256-cbc -a -salt for automated differential backups to Amazon Glacier. But I noticed that using this command increases the file size almost perfectly by 35%. In my ...
gnur's user avatar
  • 163
8 votes
4 answers
1k views

multiple dice ware lists to make memorable passphrases?

I understand the basics of why diceware produces good security and why seven word passphrases are a good idea these days. The EFF has helpfully produced updated diceware lists that eliminate lots of ...
Some Guy's user avatar
3 votes
0 answers
535 views

How strong are google's Application-specific passwords? [duplicate]

Possible Duplicate: Google Account: implications of using application-specific passwords In 2-step verification of google accounts, we need to use the Application-specific passwords generated by ...
vivek_jonam's user avatar