Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
1
vote
1answer
83 views

Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat

I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
1
vote
3answers
95 views

Why are there Hashes next to downloads? [duplicate]

I've seen several sites wehre they would put the hash of the downloadable file next to the file. Why do they do this ? I understand the purpose of comparing the hash of your file with the online hash ...
1
vote
1answer
905 views

Please help clarify password hashing - salted, multiple iterations of MD5 vs bcrypt/sha2, etc [duplicate]

I was reading an article about the Ars Technica hack here and had a couple of questions. The commenter said: "PHPass uses salted and iterated MD5 to hash passwords" My question is that if I were ...
0
votes
1answer
293 views

Using multiple hashes to verify a file

I'm dreaming of a service where a client sends my service a hash of a file that they generate locally from that file. The idea is that having such a hash would be enough to show that the user is ...
77
votes
3answers
22k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
43
votes
8answers
28k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Ideally, I'm looking ...
55
votes
5answers
14k views

Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?

I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
57
votes
3answers
29k views

What is the difference between a Hash Function and a Cryptographic Hash Function?

I mean, is it just a matter of "how difficult is it to reverse the function with the current technology"? Or is there a mathematical concept or property that makes them different? If it is a matter ...
52
votes
3answers
44k views

Is bcrypt better than scrypt [duplicate]

Possible Duplicate: Do any security experts recommend bcrypt for password storage? I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based applications ...
43
votes
12answers
11k views

Is there any real value in hashing/salting passwords?

I look after a system which holds a lot of "low grade" information, nothing financial but name/address/email etc. Someone has suggested that we up the security from the current in house password ...
27
votes
5answers
6k views

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...
77
votes
4answers
20k views

How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?

Apparently Yahoo was hacked yet again with up to a billion user accounts being compromised. The article says Yahoo uses MD5 for password hashing. Are the hackers likely to be able to crack the ...
40
votes
2answers
16k views

Is “real salt” the same as “initialization vectors”?

In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
22
votes
2answers
39k views

How are Windows 10 hashes stored if the account is setup using a Microsoft account?

I was testing the integrity of my passwords and noticed that after I dumped the hashes, there was only one account where the NTLM hash was not a "default hash." I also know that that account happens ...
75
votes
9answers
16k views

Can one tell if a password guess was close by the hash result?

I have been reading about password management lately (very interesting stuff!) and was wondering how different the hashes would be for similar strings. Is it possible to know if a password guess was ...
24
votes
5answers
6k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
70
votes
11answers
9k views

Is there any way my password is hashed, if I'm only ever asked to provide 5 out of many characters? [duplicate]

There is a system that, on a login form, presents about 40 boxes for password letters (to hide password's actual length), and only random ones (the same amount each time) are editable. Explanation is -...
26
votes
4answers
69k views

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
25
votes
6answers
20k views

Can a neural network crack hashing algorithms?

I've been reading a bit about neural networks, and their ability to approximate many complex functions. Wouldn't a neural network be capable of cracking a hashing algorithm like SHA256? For example, ...
12
votes
4answers
14k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
25
votes
4answers
12k views

How would you store a 4 digit pin code securely in the database?

I'm familiar with password hashing, using salts, bcrypt etc. But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
28
votes
4answers
6k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
24
votes
6answers
11k views

Why does some popular software still use md5?

Nowadays no one dares to defend md5 for any use, and of course they should not! However, much popular software still uses md5 in applications such as password hashing (although it's not simple/plain ...
20
votes
7answers
5k views

Why not mix hashes?

To make hashes harder to target by specialized hardware, I intuitively imagine that mixing a set of different hash algorithms should provide additional strength. For simplicity lets assume Hash1 is a ...
31
votes
1answer
12k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
29
votes
3answers
12k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
23
votes
3answers
32k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
20
votes
4answers
3k views

Should I use own constants when using well known hashing algorithms?

I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the ...
20
votes
7answers
4k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
15
votes
3answers
13k views

what is the difference between a mac and a digital signiture

I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
12
votes
2answers
7k views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
47
votes
5answers
8k views

Password security in databases - today still best practice? [duplicate]

Possible Duplicate: Which password hashing method should I use? There are a ton of great posts about password security in databases on stack overflow and on other sites and as I am completely new ...
18
votes
8answers
5k views

Won't all hashes collide after enough iterations with a static salt?

We all know that we're supposed to take a fairly slow hashing algorithm, salt the password, and run the hash for many iterations. Let's say that I'm following almost everything except for one rule, ...
10
votes
3answers
4k views

Is my session-less authentication system secure?

So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
9
votes
3answers
5k views

How often do two users use the same password

If no two users use the same password, then in theory salting the password hash is not needed. How often, in practice, do two users have the same password?
5
votes
1answer
439 views

What are the minimum parameters for Argon2?

Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords. One crucial step of Argon2 is determining the parameters used by the ...
54
votes
5answers
14k views

Is it bad practice to prefix my hash with the algorithm used?

Let's say I have a database with a bunch of users in it. This user database would typically have a hashed password per user. Would it be bad practice to prefix this hash with the hashing algorithm ...
32
votes
5answers
3k views

Password Storage - Self Encryption vs Hashing?

Self Encryption: Encrypting a password using the password itself (as a symmetric key). Basically, by doing this, I'll get random data as an output. Now, in order to retrieve the password from this ...
9
votes
4answers
3k views

What's to stop someone from just MITMing a checksum?

A lot of sites offer MD5 or SHA sums to verify the validity of your download, but why do some things rely almost entirely on this? Is there anything in place to prevent people from just replacing ...
8
votes
4answers
45k views

Extract Password Hashes from Active Directory LDAP

Currently we are working on a monthly internal security test which among other should contain a verification of the real password strength the users choose. For this reason I want to extract the ...
7
votes
3answers
13k views

Why is it necessary to match the checksum of a download with another file provided by the same server? [duplicate]

Possible Duplicate: Does hashing a file from an unsigned website give a false sense of security? On many servers providing files for download, there is a file on which checksums are provided for ...
5
votes
4answers
21k views

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
5
votes
4answers
6k views

Brute force vs other methods of recovering passwords from shadow file

Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file? On various operating systems, any good solutions/methods/programs. Or is it better to upload ...
28
votes
3answers
5k views

Can I share what password hash function I used in a public report?

I have developed a web site during an internship, using a database with accounts. I used the crypt() method from PHP, with a secured algorithm plus salt (found on the web with a lot of feedback). ...
13
votes
3answers
466 views

Can client-side hashing improve after-the-fact security in response to password leaks?

Several questions on this site address client-side password hashing, and none of them admit to any security benefit beyond protecting other sites the user might use the same password for. However, ...
13
votes
1answer
3k views

Should I hash my passwords even if I am only allowed to generate limited traffic?

At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic. My question is: Does hashing the ...
12
votes
4answers
4k views

Handling passwords in a web application

I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
10
votes
1answer
3k views

Why store a salt along side the hashed password? [duplicate]

Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts. What I would like to understand is why you would store the salt along side the ...
10
votes
4answers
3k views

Does hashing a PRNG make it cryptographically secure?

Would hashing the result of a regular random number generator produce a cryptographically secure PRNG? For example, would sha1(rand()) effectively be a secure PRNG? Assuming it doesn't, how would ...
10
votes
3answers
4k views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...

1
4
5
6 7 8