Linked Questions

0
votes
0answers
28 views

Is a combination of user login and site domain a sensible salt? [duplicate]

Just out of curiosity (since I know the established password hashing libraries should provide "proper" random salts), would a combination of the user login and the respective site's domain (or a hash ...
837
votes
13answers
240k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
523
votes
11answers
81k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
509
votes
6answers
151k views

How to store salt?

If you expect to store user password securely, you need to do at least the following: $pwd=hash(hash($password) + salt) Then, you store $pwd in your system instead of the real password. I have seen ...
229
votes
7answers
85k views

Password Hashing: add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
79
votes
5answers
76k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
78
votes
4answers
16k views

Why add username to salt before hashing a password?

I have seen examples of password hashing that were: H(username + salt + password). What is the purpose of adding username? Is there any purpose?
49
votes
4answers
19k views

Why is using salt more secure?

Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
39
votes
5answers
24k views

Confused about (password) entropy

There seem to be many different 'kinds' of entropy. I've come across two different concepts: A) The XKCD example of correcthorsebatterystaple. It has 44 bits of entropy because four words randomly ...
23
votes
5answers
3k views

When hashing passwords, is it ok to use the hashed password as the salt?

I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is: $passwd = 'foo'; $salt = hash($passwd); $finalHash = hash($passwd ...
23
votes
2answers
5k views

What is the purpose of a Pepper?

I've been trying to find out exactly what a pepper is. The only things I could accurately determine are that a Pepper: Is theoretically unique from site to site and hard-coded in the site's source Is ...
11
votes
3answers
557 views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
3
votes
5answers
670 views

Are hash functions “strongest link”?

It seems to me that if you were to use multiple hash functions, the "strongest link" would hold up the others. For example: HelloWorld --- md5 --> 68e109f0f40ca72a15e05cc22786f8e6 --- sha256 --&...
2
votes
4answers
398 views

Random salt - necessary for a single user?

Based on: https://security.stackexchange.com/a/33520/42220 and https://security.stackexchange.com/a/41630/42220 I can see the benefits of a completely random salt per user. If I am implementing an ...
4
votes
3answers
548 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...