Linked Questions

943 votes
11 answers

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
AviD's user avatar
  • 73.3k
668 votes
4 answers

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
Sam Saffron's user avatar
  • 6,765
78 votes
4 answers

How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?

Apparently Yahoo was hacked yet again with up to a billion user accounts being compromised. The article says Yahoo uses MD5 for password hashing. Are the hackers likely to be able to crack the ...
soadyp's user avatar
  • 895
49 votes
11 answers

Why are only passwords hashed?

I just learned a few things about hashing algorithms – MD5 and SHA-1. So, if I am not wrong passwords are hashed so that in a rare situation of your database being compromised a hacker can not see all ...
Aman Kothari's user avatar
22 votes
3 answers

MySQL OLD_PASSWORD cryptanalysis?

The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
nealmcb's user avatar
  • 20.8k
16 votes
2 answers

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
Alex Tape's user avatar
  • 263
15 votes
1 answer

HQL injection example

Our developers left a surprise in handling user login. Namely: // java List users = hibernate.find("from Users where username = '"+formUsername+"'"; if (users.length==0) { return BAD_USER; } if (!...
Pawel Veselov's user avatar
8 votes
3 answers

Is Using MD5 Sufficient Reason to Reject This Payment Processor?

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
David Alan Hjelle's user avatar
7 votes
4 answers

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
user49654's user avatar
7 votes
1 answer

Is possible to force a file to generate an specific MD5 signature?

Sometimes MD5 is used to validate that a downloaded file is really valid. So I want to know if is possible for a hacker to modify a file and introduce some malicious code AND make that file generate ...
IAmJulianAcosta's user avatar
6 votes
1 answer

Securely displaying hidden integers with MD5

A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
Ivan T.'s user avatar
  • 1,053
5 votes
4 answers

Cisco IOS service password-encryption

In Cisco IOS there's the service password-encryption command to encrypt all passwords in the config file to prevent unauthorized individuals from viewing them. quoting from
cyzczy's user avatar
  • 1,588
4 votes
1 answer

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
user49637's user avatar
  • 733
2 votes
2 answers

MD5 brute force on a faulty hash?

MD5 for passwords is considered insecure due to the ability to brute force and pick up the result. But what if I change some characters of an MD5 hash and I keep a record of that change so that ...
rakibtg's user avatar
  • 145
2 votes
2 answers

Is a long salt usually sufficient for security purposes, even with MD5?

I always hear that MD5 is too fast for effective password crypto because you can crack up to 6 characters very quickly (or is this number higher now)? But what if the salt you use is really long and ...
user2175923's user avatar

15 30 50 per page