Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 2113

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

22
votes
No, this is not safe You should generate a long random number and store it in a cookie. This random number is essentially just another password for this user. So, on the serverside, you only store a …
answered Dec 5 '11 by Jacco
0
votes
Send a password by email is not considered to be secure. There are several issues with sending passwords by email: The email travels in plain text across the internet. As a result, a Man-in-the …
answered Apr 21 '16 by Jacco
4
votes
application wide secret key into your salted passwords. This could protect you against partial breaches (such as database compromises through, for example, SQL-injection), but won't help in case of full system breaches, unless you use a Hardware Security Modules (HSM) to protect the pepper value. …
answered Jul 25 '16 by Jacco
1
vote
this particular salt, prior to obtaining a copy of you hashed passwords. When he does get the copy of the hashed passwords (for example by a SQL-injection attack) he can now immediately attempt to …
answered Oct 1 '12 by Jacco
3
votes
You should send the plain text password (over HTTPS) and do the hashing on the server side. If you would do the hashing before sending it to the server, the hash of the password effectively became th …
answered Sep 27 '17 by Jacco
17
votes
For password storage, salted SHA256 hashes are not recommended. This is because the general purpose SHA256 is designed to be fast. Fast is exactly what you do not want for a password hashing algorithm …
answered Jun 29 '17 by Jacco
80
votes
interest: How to securely hash passwords? Password Hashing add salt + pepper or is salt enough? Salt Generation and open source software …
answered Jul 20 '12 by Jacco
8
votes
If you are not using a secured connection (https) then your schema is flawed in several ways: The hashed password is all that is needed to log in: you are vulnerable to a replay attack; Since the co …
answered Mar 8 '16 by Jacco
4
votes
user. If you have only a derived value, you can't contact them. Pre hashed passwords BCrypt truncates any password to 55 bytes of input (excluding the salt). 55 bytes may not seem like a lot in the … light of commonly quoted values of 128 bits, 256 bits or even 1024 bits. However, common passwords are reality of lengths in the range of 6 to 10 characters. If you wanted to allow for longer values …
answered Nov 2 '12 by Jacco
229
votes
7answers
. Related How to apply a pepper correctly to bcrypt? How to securely hash passwords? HMAC - Why not HMAC for password storage? Background As far as I know, the recommended/approved method for … harder. So, my question is: Does adding a pepper value in addition to a salt when hashing passwords increase the overall security? Or is the perceived increased security based on false assumptions …
asked Apr 22 '11 by Jacco
1
vote
Very nice initiative! Quick comments (I will read the RFC in more detail later.) 'salts only need to be unique in a system' is a faulty assumption; please also read: this answer on salting I do n …
answered Aug 21 '12 by Jacco
3
votes
There are several flaws: First, I don't see why you would want to "reinforce the use of existing lib (Bcrypt mainly)". Either you use a solid password hashing algorithm (BCrypt is good) or you don't. …
answered Sep 14 '17 by Jacco
14
votes
A salt is not a secret, it is meant to make the Hash/PBKDF2 result unique to each used instance. As far as a know, the very definition of salt requires it to be random for each computed hash. If it wa …
answered May 14 '12 by Jacco