Linked Questions
114 questions linked to/from Why shouldn't we roll our own?
5
votes
2
answers
967
views
Why not slightly modify an existing hashfunction to create your own? [duplicate]
I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...
- 343
1
vote
2
answers
3k
views
What is a good way to generate a one time pad, and is this a good way? [duplicate]
Is there a good/better/best way to generate a one time pad? I would like to only utilize about 40 characters (a-z, 0-9, .,!-).
What I have come up with is perhaps not the BEST way, but seems to fill ...
1
vote
1
answer
206
views
Where to submit an algorithm for analysis? [duplicate]
I'm developing a cryptographic toolkit and plan to employ custom algorithms for hashing, password stretching, etc. Is there a way I can get them analysed? Yes, I can post it on my website and on sites ...
1
vote
2
answers
200
views
Reason for not implementing own algorithms/implementations [duplicate]
I get that people don't want to encourage other people to implement their own algorithms/implementations of algorithms due to safety issues. But on the other hand, questions about creating your own ...
- 13
67
votes
21
answers
69k
views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
- 50.6k
94
votes
10
answers
18k
views
Does anybody not store salts?
We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
- 1,059
85
votes
10
answers
10k
views
Why improvising your own Hash function out of existing hash functions is so bad
I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes.
After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
- 1,538
66
votes
7
answers
19k
views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
- 771
32
votes
9
answers
24k
views
How to secure passwords over HTTP?
Say my password is abc. I want to send it to the server over HTTP.
I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
- 455
43
votes
9
answers
19k
views
Is salting a hash really as secure as common knowledge implies?
I'm implementing a salt function for user passwords on my web page, and I'm wondering about some things.
A salt is an extension added to a password and then hashed, meaning the password is stored in ...
44
votes
11
answers
8k
views
Isn't all security "through obscurity"?
I know that one shouldn't rely on "obscurity" for their security. For example, choosing a non-standard port is not really security, but it also doesn't usually hurt to do so (and may help mitigate ...
- 3,232
72
votes
5
answers
15k
views
What makes Random Number Generators so fragile?
It seems to me that a hardware component which generates random numbers is extremely simple - just measure tiny vibrations in the hardware with a sensor, right? Maybe I'm wrong but it seems like if ...
- 775
25
votes
6
answers
9k
views
What would be the key size for a picture used as a key?
I'm working on a cryptosystem that uses colour pictures as keys for encryption. I'm trying to guess what is the key size of my cryptosystem in order to find the feasibility of a brute force attack. My ...
57
votes
4
answers
5k
views
What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
- 62k
42
votes
6
answers
86k
views
What is the simplest safe way to convey a password to another person? [duplicate]
What is the easiest way for two people – neither of whom are computer specialists and cannot meet in person – to send a password for an encrypted file that is attached to an email?
The two simplest ...
- 1,007