Linked Questions

943 votes
11 answers

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
AviD's user avatar
  • 73.3k
668 votes
4 answers

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
Sam Saffron's user avatar
  • 6,765
49 votes
11 answers

Why are only passwords hashed?

I just learned a few things about hashing algorithms – MD5 and SHA-1. So, if I am not wrong passwords are hashed so that in a rare situation of your database being compromised a hacker can not see all ...
Aman Kothari's user avatar
78 votes
4 answers

How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?

Apparently Yahoo was hacked yet again with up to a billion user accounts being compromised. The article says Yahoo uses MD5 for password hashing. Are the hackers likely to be able to crack the ...
soadyp's user avatar
  • 895
16 votes
2 answers

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
Alex Tape's user avatar
  • 263
22 votes
3 answers

MySQL OLD_PASSWORD cryptanalysis?

The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
nealmcb's user avatar
  • 20.8k
7 votes
4 answers

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
user49654's user avatar
1 vote
2 answers

How can this website crack MD5 hashes? [closed]

I have heard that hashing, such as MD5, is one-way and cannot be cracked. But there are some websites that can decrypt hash, like and some scripts like I tested some ...
kst's user avatar
  • 131
5 votes
4 answers

Cisco IOS service password-encryption

In Cisco IOS there's the service password-encryption command to encrypt all passwords in the config file to prevent unauthorized individuals from viewing them. quoting from
cyzczy's user avatar
  • 1,588
7 votes
1 answer

Is possible to force a file to generate an specific MD5 signature?

Sometimes MD5 is used to validate that a downloaded file is really valid. So I want to know if is possible for a hacker to modify a file and introduce some malicious code AND make that file generate ...
IAmJulianAcosta's user avatar
8 votes
3 answers

Is Using MD5 Sufficient Reason to Reject This Payment Processor?

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
David Alan Hjelle's user avatar
15 votes
1 answer

HQL injection example

Our developers left a surprise in handling user login. Namely: // java List users = hibernate.find("from Users where username = '"+formUsername+"'"; if (users.length==0) { return BAD_USER; } if (!...
Pawel Veselov's user avatar
1 vote
2 answers

Tool for generating MD4 collisions

There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these. Uptill now I have used tools like John the Ripper ...
Kshitiz Sharma's user avatar
4 votes
1 answer

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
user49637's user avatar
  • 733
-3 votes
2 answers

Is possible to fake md5sum? [closed]

Without brute forcing, is possible to induce to a result on md5sum of a file, for example a file text? is mathematically "makeable"? The only way is using brute-forcing techniques? In other words it ...
André Vinícius's user avatar
2 votes
2 answers

MD5 brute force on a faulty hash?

MD5 for passwords is considered insecure due to the ability to brute force and pick up the result. But what if I change some characters of an MD5 hash and I keep a record of that change so that ...
rakibtg's user avatar
  • 145
6 votes
1 answer

Securely displaying hidden integers with MD5

A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
Ivan T.'s user avatar
  • 1,053
2 votes
3 answers

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
Dee's user avatar
  • 23
0 votes
1 answer

Using MD5 as salt

I know that MD5 is a poor choice for hashing passwords, but its not my ideia. Imagine that we would use the username as a salting mechanism, wich is also bad idea, but just for an example. First, we ...
h0m3's user avatar
  • 1
2 votes
2 answers

Is a long salt usually sufficient for security purposes, even with MD5?

I always hear that MD5 is too fast for effective password crypto because you can crack up to 6 characters very quickly (or is this number higher now)? But what if the salt you use is really long and ...
user2175923's user avatar
2 votes
1 answer

Is MD5 ok to use if salted?

This post: Said that salted MD5 is ok but regular MD5 would not be ok. I am a bit confused about this and would ...
John Doe's user avatar
0 votes
2 answers

How do online banking applications work? [closed]

It's suprisingly hard to find concrete information about that topic. I've worked with the Flask framework lately and I just managed to create a proper login that stores the passwords in a database ...
jz22's user avatar
  • 103
1 vote
1 answer

Synchronized nonce

If two parties (Say A and B) have a shared secret key (K), is there any way for each party to use the shared secret key to generate nonce(N) sequence which is equal on both sides without having to ...
user1677104's user avatar