Linked Questions

12 votes
2 answers

If multiple users on the same website all use the same password, is their password hash the same? [duplicate]

My basic knowledge would assume yes, unless websites somehow include the user name into the hashing function with the password, but I am not sure if this is common practice.
Just's user avatar
  • 121
5 votes
5 answers

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
Noob's user avatar
  • 491
5 votes
5 answers

Why can salts be public? [duplicate]

From what I understand, salts are called "salts" rather than "keys" because they are allowed to be public. I understand that applying a random salt makes it difficult for rainbow table attacks because ...
Timothy Deng's user avatar
0 votes
2 answers

How does salting increase security? [duplicate]

I'm currently going through a course on software security. I've recently been introduced to the idea of password salting, where a random value is concatenated to a password prior to being hashed and ...
vbiqvitovs's user avatar
1 vote
2 answers

Hashing password with salt [duplicate]

I read from wiki: The attacker has access to both the hashed password and the salt, so when running the dictionary attack, the attacker can simply use the known salt when attempting to crack the ...
xcoder's user avatar
  • 137
-1 votes
1 answer

What does hashing with salt protect against, and how do user hash and server hash match? [duplicate]

Hashing with salt is a better approach for security. I want to know what kind of attack salting protects against, eg. eavesdropping. Next, I want to know if the salt value is the same for the same ...
kst's user avatar
  • 131
0 votes
1 answer

Question about storing salt values and hashed passwords in the database [duplicate]

So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
mantot123's user avatar
178 votes
18 answers

What is a good analogy to explain to a layman why passwords should be hashed?

Note: This is not an actual situation I'm currently in. Assume your boss is one of those old-fashioned computer-illiterate managers and wants to store the passwords in plaintext to simplify ...
Nzall's user avatar
  • 7,423
78 votes
8 answers

Convincing my manager to use salts

My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active ...
user46866's user avatar
  • 881
79 votes
4 answers

Why add username to salt before hashing a password?

I have seen examples of password hashing that were: H(username + salt + password). What is the purpose of adding username? Is there any purpose?
JustinLovinger's user avatar
53 votes
4 answers

Is using SHA-512 for storing passwords tolerable?

I know that the best options to use for storing passwords are bcrypt/PBKDF2/scrypt. However, suppose you have to audit a system and it uses SHA-512 with salt. Is that "fine"? Or it is a vulnerability ...
Bozho's user avatar
  • 1,223
44 votes
6 answers

Length of passwords that are rainbow table safe

With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
rubo77's user avatar
  • 2,390
54 votes
3 answers

Secret salts; why do they slow down attacker more than they do me?

When studying Dan Boneh's slides for 'Session Management and User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58). He suggest to store in the ...
harm's user avatar
  • 593
28 votes
5 answers

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...
Allahjane's user avatar
  • 437
18 votes
2 answers

What's the difference between a hashed and an encrypted password?

Alright, so I know this may sound dumb, but I'm having a hard time understanding what an encryption would be since it's different from a hash. I've read up on it, but I'm still not quite sure. So, I ...
UnderMyWheel's user avatar

15 30 50 per page