Linked Questions
84 questions linked to/from Do any security experts recommend bcrypt for password storage?
60
votes
3
answers
51k
views
Is bcrypt better than scrypt [duplicate]
Possible Duplicate:
Do any security experts recommend bcrypt for password storage?
I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based applications ...
- 711
1
vote
0
answers
352
views
Recomended hash algorithm [duplicate]
Possible Duplicate:
How to securely hash passwords?
Do any security experts recommend bcrypt for password storage?
What would you choose between:
PBKDF2 SHA256 (270,000 iterations)
bcrypt (12, ...
917
votes
11
answers
299k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 71.8k
540
votes
11
answers
90k
views
Is my developer's home-brew password security right or wrong, and why?
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below.
His team spent months adopting an industry standard protocol using Bcrypt. ...
- 4,669
262
votes
7
answers
107k
views
Password Hashing: add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
- 7,322
151
votes
11
answers
86k
views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
- 1,745
102
votes
7
answers
128k
views
Is MD5 considered insecure?
After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
- 2,512
94
votes
5
answers
83k
views
What is the specific reason to prefer bcrypt or PBKDF2 over SHA256-crypt in password hashes?
We know that to slow down password cracking in case a password database leak, passwords should be saved only in a hashed format. And not only that, but hashed with a strong and slow function with a ...
- 2,066
53
votes
4
answers
22k
views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
- 1,395
31
votes
7
answers
17k
views
Is AES encrypting a password with itself more secure than SHA1?
This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
skier88
45
votes
4
answers
20k
views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good salt?...
- 621
68
votes
2
answers
11k
views
Pre-hash password before applying bcrypt to avoid restricting password length
Good practice is not to unnecessarily restrict password length, so that appropriately-long passphrases (perhaps 35-45 chars for 6/7 dicewords) can be used. (See e.g. Should I have a maximum password ...
- 2,699
58
votes
2
answers
36k
views
I just send username and password over https. Is this ok?
When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
- 947
28
votes
6
answers
5k
views
Hash function change
I have user account passwords stored in a database using an unsafe (old) cryptographic hash function.
What is the best/usual approach to changing password hash function? Only two ideas come to my ...
- 383
33
votes
5
answers
4k
views
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line.
I want to increase the cost every year of my users passwords.
One solution is to recalculate them when ...
- 431