Linked Questions

9
votes
5answers
2k views

Should I remotely store my salt? [duplicate]

When users register on my site, I want to store their username and hashed password in my database. When I hash that password, I'm going to salt it using PHP. The issue is, I don't want to store the ...
10
votes
1answer
3k views

Why store a salt along side the hashed password? [duplicate]

Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts. What I would like to understand is why you would store the salt along side the ...
5
votes
5answers
2k views

How secure is it to keep the salt with the password hash? [duplicate]

In Linux we have the salt just next to the password hash in the /etc/shadows file. I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
5
votes
1answer
5k views

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I will ...
2
votes
2answers
2k views

Is it secure to store the salt along with the hashed password in the database? [duplicate]

After reading some posts and articles about how to store user credentials in a database, in which all said that we should use a different salt for each user and save the salt in the database along ...
3
votes
2answers
873 views

Why does saving a salt as plain text still improve security? [duplicate]

I mean, for example you use salting to protect your password against a dictionary attack. But when I know that the salt from User X is jd38d83h8fh08h (because it is saved as plain text together with ...
0
votes
2answers
242 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
1
vote
1answer
105 views

Password hashing with salt. Where do you leave the salt? [duplicate]

I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that: The salt should be random. The salt should not be reused. Using hashing without salt makes ...
0
votes
3answers
126 views

Are Salt strings stored by application? [duplicate]

1) As storing passwords in plain text in databases are not secure and so is not a good practice. password stored in db = "abcde" (plain text) 2) To avoid this, passwords are stored after being hashed ...
0
votes
0answers
64 views

Why people buy stolen databases with emails and hashed passwords of users? [duplicate]

I see every now and then how hackers stole DB with emails and hashed passwords of millions of users from popular websites and sell it on the black market. I assume that passwords were hashed with ...
0
votes
0answers
14 views

Save salt in DB [duplicate]

I'm trying to create a random salt on the user thing and complement the salt on the user thing in the DB. Is it safe to add salt to DB? If you attack DB and salt is stolen, there is a concern that ...
856
votes
13answers
255k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
530
votes
11answers
84k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
237
votes
7answers
90k views

Password Hashing: add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
102
votes
5answers
62k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?

15 30 50 per page
1
2 3 4 5