184
votes
Accepted
Is HostGator storing my password in plaintext?
Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).
Technically, the password might be stored under reversible encryption rather than plain text, but ...
- 46.4k
127
votes
Accepted
Can I conceal which account in my database is the admin account, so an attacker won't know which hash to crack first?
I would say this is a bit too much trouble considering what you get out of it. I think when the attacker has access to the database you have way bigger problems. Obfuscating the admin status of a user ...
- 1,212
122
votes
Accepted
Is it safe/wise to store a salt in the same field as the hashed password?
You should store it in a single field. Do not try to divide it into parts.
I know this might seem a bit unintuitive for people coming from a database background, where the modus operandi is to ...
- 65.4k
119
votes
Would removing spaces in a string protect against SQL injection?
No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied ...
- 5,959
107
votes
Accepted
Why is credit card information not stolen more often?
PCI DSS
The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform ...
- 8,429
103
votes
Accepted
Storing weakness level of passwords
Password hashing (with salting and slowness) is designed to make it indistinguishable from just having the hash if a password is weak or strong. Adding an additional indicator about the quality of the ...
- 199k
97
votes
Accepted
Is a sha256 hash of a unix timestamp a strong password
... for an entropy of ~330 bits, ...
The question is not how strong a password looks like but how strong it actually is. SHA-256 does not add any entropy at all, so it all depends on what the input ...
- 199k
82
votes
Is HostGator storing my password in plaintext?
Yes, they store passwords in plaintext or equivalent, and definitely transmit them in plain text. This was discovered in 2011.
This is confirmed HostGator being listed on Plaintext Offenders, as well ...
- 66.5k
78
votes
Sequential identifying string that can't be reverse engineered (the "invoice number" problem)
The standard approach to this kind of issue is to create a UUID (Universally Unique Identifier) for each picture. This is generally a random 128-bit identifier which you can assign to each picture ...
- 62.1k
69
votes
Accepted
Is using a DB prefix for tables more secure?
This is security through obscurity. While it might not hurt you in all cases, on it's own it does not provide viable security. Do not rely on this as your protection.
A short parable
Let's say you ...
- 65.4k
67
votes
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function
The problem of SQL injection is essentially the mixing of logic and data, where what should be data is treated as logic. Prepared statements and parameterized queries actually solve this issue at the ...
- 12.7k
53
votes
Accepted
Does password-protecting a database living next to the application add any security?
It makes sense to password protect the database if you secure access to the application's config file that holds the plaintext credentials. When you restrict read access to the application's account ...
- 1,726
49
votes
Would removing spaces in a string protect against SQL injection?
We're in 2016! SQL injections are a thing of the past unless you use insecure code.
Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other ...
- 1,969
49
votes
Is it safe/wise to store a salt in the same field as the hashed password?
What you're missing is that hashes work on the original data, minus the original string. When you want to validate a string against a hash, you take the supplied string, plus the original hash data (...
- 3,818
47
votes
Accepted
Is this safe to display MySQL query error in webpage if something went wrong?
End users should never get to see the gory details of your environment.
Instead it is more professional to show a generic 'Sorry something went wrong' page. At least visitors can see that you have a ...
- 7,847
47
votes
Accepted
Secure Implementation of Password Database
The current general best practices for authentication are in the NIST SP 800-63-3 Digital Identity Guidelines standards, especially in SP-63B Authentication and Lifecycle Management.
These NIST ...
- 6,040
46
votes
Is a sha256 hash of a unix timestamp a strong password
Password complexity is not a matter of having a bunch of random-ish characters.
The purpose of password complexity is to make your password harder to guess, not to make your password "look random....
- 926
35
votes
Accepted
Client-side BCrypt, store salt and hash separately in MySQL database
The client is the attacker. Walk around your office while chanting that sentence 144 times; be sure to punctuate your diction with a small drum. That way, you will remember it.
In your server, you ...
- 172k
35
votes
Accepted
Is this passwordless system secure?
No, this doesn't seem secure.
Collisions
Mersenne Twister is a deterministic RNG, so it's not suitable for most cryptographic tasks (although it's usage makes sense, because if it weren't ...
- 29.5k
33
votes
Sql database password encryption opinion needed
No, this is not a good idea!
As Lukas pointed out in an comment, you want to hash a password, never encrypt it!
With your schema, it would be possible to get the plaintext passwords from an database ...
- 5,973
33
votes
Direct access to databases
Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries.
...
PCI DSS requirement 8.7 stats "Only database ...
- 72.7k
30
votes
Sequential identifying string that can't be reverse engineered (the "invoice number" problem)
I would simply use the picture hash. What's the problem with someone figuring out the hash you used? If I think "this part of the url looks like a sha1", download the file and it has that sha1, I was ...
- 18.8k
27
votes
KeePass security local malware
Yes - if the malware included a keylogger, for example, it could simply read the master password when you typed it in. The only real way to prevent that would be to have KeePass be the only software ...
- 27.4k
27
votes
Business founder wants access to database but has no DB skills
He is the Data Owner. Not you. If you get hit by a bus, he will need access. You should absolutely give him access. This request is not a surprise at all. If you built a website for me, I'd ask the ...
- 128k
26
votes
Can I conceal which account in my database is the admin account, so an attacker won't know which hash to crack first?
Security through obfuscation has limited effectiveness at best - to determine if it is suitable, you need to understand what threats you want to counter. If a threat actor can read your database ...
- 128k
26
votes
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function
I think the main question here is why string escaping is not as good as the other methods.
The answer is that some edge cases allow injections to slip through even though they are escaped. Stack ...
- 831
23
votes
Accepted
Exposing database fields names in HTML
It is very common to do this. As you've noticed, there is a significant benefit for keeping code simple.
If you do have an SQL injection vulnerability, an attacker can figure out your database ...
- 33.4k
23
votes
Accepted
Is deleting files from a database considered a denial of service attack?
Yes, in the sense that anything which "denies service" is a "denial of service".
The CIA Triad defines information security as anything which affects Confidentiality, Integrity, or Availability of ...
- 58.8k
22
votes
Does password-protecting a database living next to the application add any security?
That is kind of an onion protection (also known as "Layered Security" or "Defense in Depth" as seen, for example, in SANS' "Layered Security: Why It Works" whitepaper). If an attacker can reach the ...
- 26.5k
Only top scored, non community-wiki answers of a minimum length are eligible