Linked Questions

0
votes
0answers
28 views

Is a combination of user login and site domain a sensible salt? [duplicate]

Just out of curiosity (since I know the established password hashing libraries should provide "proper" random salts), would a combination of the user login and the respective site's domain (or a hash ...
810
votes
12answers
223k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
498
votes
11answers
74k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
493
votes
6answers
137k views

How to store salt?

Nowadays, if we expect to store user password securely, we need at least do the following thing: $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have ...
221
votes
7answers
80k views

Password Hashing: add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
77
votes
5answers
74k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
78
votes
4answers
16k views

Why add username to salt before hashing a password?

I have seen examples of password hashing that were: H(username + salt + password). What is the purpose of adding username? Is there any purpose?
48
votes
4answers
18k views

Why is using salt more secure?

Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
39
votes
5answers
23k views

Confused about (password) entropy

There seem to be many different 'kinds' of entropy. I've come across two different concepts: A) The XKCD example of correcthorsebatterystaple. It has 44 bits of entropy because four words randomly ...
23
votes
5answers
3k views

When hashing passwords, is it ok to use the hashed password as the salt?

I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is: $passwd = 'foo'; $salt = hash($passwd); $finalHash = hash($passwd ...
21
votes
2answers
5k views

What is the purpose of a Pepper?

I've been trying to find out exactly what a pepper is. The only things I could accurately determine are that a Pepper: Is theoretically unique from site to site and hard-coded in the site's source Is ...
11
votes
3answers
492 views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
3
votes
5answers
665 views

Are hash functions “strongest link”?

It seems to me that if you were to use multiple hash functions, the "strongest link" would hold up the others. For example: HelloWorld --- md5 --> 68e109f0f40ca72a15e05cc22786f8e6 --- sha256 --&...
2
votes
4answers
328 views

Random salt - necessary for a single user?

Based on: https://security.stackexchange.com/a/33520/42220 and https://security.stackexchange.com/a/41630/42220 I can see the benefits of a completely random salt per user. If I am implementing an ...
4
votes
3answers
525 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...