Linked Questions

942 votes
11 answers

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
AviD's user avatar
  • 73.3k
667 votes
4 answers

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
Sam Saffron's user avatar
  • 6,755
49 votes
11 answers

Why are only passwords hashed?

I just learned a few things about hashing algorithms – MD5 and SHA-1. So, if I am not wrong passwords are hashed so that in a rare situation of your database being compromised a hacker can not see all ...
Aman Kothari's user avatar
78 votes
4 answers

How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?

Apparently Yahoo was hacked yet again with up to a billion user accounts being compromised. The article says Yahoo uses MD5 for password hashing. Are the hackers likely to be able to crack the ...
soadyp's user avatar
  • 895
16 votes
2 answers

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
Alex Tape's user avatar
  • 263
22 votes
3 answers

MySQL OLD_PASSWORD cryptanalysis?

The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
nealmcb's user avatar
  • 20.8k
7 votes
4 answers

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
user49654's user avatar
1 vote
2 answers

How can this website crack MD5 hashes? [closed]

I have heard that hashing, such as MD5, is one-way and cannot be cracked. But there are some websites that can decrypt hash, like and some scripts like I tested some ...
kst's user avatar
  • 131
5 votes
4 answers

Cisco IOS service password-encryption

In Cisco IOS there's the service password-encryption command to encrypt all passwords in the config file to prevent unauthorized individuals from viewing them. quoting from
cyzczy's user avatar
  • 1,578
7 votes
1 answer

Is possible to force a file to generate an specific MD5 signature?

Sometimes MD5 is used to validate that a downloaded file is really valid. So I want to know if is possible for a hacker to modify a file and introduce some malicious code AND make that file generate ...
IAmJulianAcosta's user avatar
15 votes
1 answer

HQL injection example

Our developers left a surprise in handling user login. Namely: // java List users = hibernate.find("from Users where username = '"+formUsername+"'"; if (users.length==0) { return BAD_USER; } if (!...
Pawel Veselov's user avatar
8 votes
3 answers

Is Using MD5 Sufficient Reason to Reject This Payment Processor?

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
David Alan Hjelle's user avatar
1 vote
2 answers

Tool for generating MD4 collisions

There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these. Uptill now I have used tools like John the Ripper ...
Kshitiz Sharma's user avatar
4 votes
1 answer

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
user49637's user avatar
  • 733
-3 votes
2 answers

Is possible to fake md5sum? [closed]

Without brute forcing, is possible to induce to a result on md5sum of a file, for example a file text? is mathematically "makeable"? The only way is using brute-forcing techniques? In other words it ...
André Vinícius's user avatar

15 30 50 per page