Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
182 votes
Accepted

Is HostGator storing my password in plaintext?

Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one). Technically, the password might be stored under reversible encryption rather than plain text, but ...
CBHacking's user avatar
  • 48.9k
126 votes
Accepted

Can I conceal which account in my database is the admin account, so an attacker won't know which hash to crack first?

I would say this is a bit too much trouble considering what you get out of it. I think when the attacker has access to the database you have way bigger problems. Obfuscating the admin status of a user ...
Black Magic's user avatar
  • 1,212
121 votes
Accepted

Is it safe/wise to store a salt in the same field as the hashed password?

You should store it in a single field. Do not try to divide it into parts. I know this might seem a bit unintuitive for people coming from a database background, where the modus operandi is to ...
Anders's user avatar
  • 65.6k
119 votes

Would removing spaces in a string protect against SQL injection?

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied ...
wireghoul's user avatar
  • 5,959
107 votes
Accepted

Why is credit card information not stolen more often?

PCI DSS The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform ...
Peteris's user avatar
  • 8,429
103 votes
Accepted

Storing weakness level of passwords

Password hashing (with salting and slowness) is designed to make it indistinguishable from just having the hash if a password is weak or strong. Adding an additional indicator about the quality of the ...
Steffen Ullrich's user avatar
97 votes
Accepted

Is a sha256 hash of a unix timestamp a strong password

... for an entropy of ~330 bits, ... The question is not how strong a password looks like but how strong it actually is. SHA-256 does not add any entropy at all, so it all depends on what the input ...
Steffen Ullrich's user avatar
82 votes

Is HostGator storing my password in plaintext?

Yes, they store passwords in plaintext or equivalent, and definitely transmit them in plain text. This was discovered in 2011. This is confirmed HostGator being listed on Plaintext Offenders, as well ...
forest's user avatar
  • 66.8k
68 votes
Accepted

Is using a DB prefix for tables more secure?

This is security through obscurity. While it might not hurt you in all cases, on it's own it does not provide viable security. Do not rely on this as your protection. A short parable Let's say you ...
Anders's user avatar
  • 65.6k
67 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

The problem of SQL injection is essentially the mixing of logic and data, where what should be data is treated as logic. Prepared statements and parameterized queries actually solve this issue at the ...
multithr3at3d's user avatar
53 votes
Accepted

Does password-protecting a database living next to the application add any security?

It makes sense to password protect the database if you secure access to the application's config file that holds the plaintext credentials. When you restrict read access to the application's account ...
Stef Heylen's user avatar
  • 1,736
49 votes

Would removing spaces in a string protect against SQL injection?

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other ...
Julie Pelletier's user avatar
48 votes

Is it safe/wise to store a salt in the same field as the hashed password?

What you're missing is that hashes work on the original data, minus the original string. When you want to validate a string against a hash, you take the supplied string, plus the original hash data (...
Machavity's user avatar
  • 3,798
47 votes
Accepted

Secure Implementation of Password Database

The current general best practices for authentication are in the NIST SP 800-63-3 Digital Identity Guidelines standards, especially in SP-63B Authentication and Lifecycle Management. These NIST ...
Ghedipunk's user avatar
  • 6,050
46 votes
Accepted

Is this safe to display MySQL query error in webpage if something went wrong?

End users should never get to see the gory details of your environment. Instead it is more professional to show a generic 'Sorry something went wrong' page. At least visitors can see that you have a ...
Kate's user avatar
  • 8,345
46 votes

Is a sha256 hash of a unix timestamp a strong password

Password complexity is not a matter of having a bunch of random-ish characters. The purpose of password complexity is to make your password harder to guess, not to make your password "look random....
Kevin's user avatar
  • 936
35 votes
Accepted

Client-side BCrypt, store salt and hash separately in MySQL database

The client is the attacker. Walk around your office while chanting that sentence 144 times; be sure to punctuate your diction with a small drum. That way, you will remember it. In your server, you ...
Tom Leek's user avatar
  • 173k
35 votes
Accepted

Is this passwordless system secure?

No, this doesn't seem secure. Collisions Mersenne Twister is a deterministic RNG, so it's not suitable for most cryptographic tasks (although it's usage makes sense, because if it weren't ...
tim's user avatar
  • 29.6k
33 votes

Sql database password encryption opinion needed

No, this is not a good idea! As Lukas pointed out in an comment, you want to hash a password, never encrypt it! With your schema, it would be possible to get the plaintext passwords from an database ...
Josef's user avatar
  • 5,953
32 votes

Direct access to databases

Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries. ... PCI DSS requirement 8.7 stats "Only database ...
gowenfawr's user avatar
  • 72.8k
28 votes

Business founder wants access to database but has no DB skills

He is the Data Owner. Not you. If you get hit by a bus, he will need access. You should absolutely give him access. This request is not a surprise at all. If you built a website for me, I'd ask the ...
schroeder's user avatar
  • 130k
27 votes

KeePass security local malware

Yes - if the malware included a keylogger, for example, it could simply read the master password when you typed it in. The only real way to prevent that would be to have KeePass be the only software ...
Matthew's user avatar
  • 27.3k
26 votes

Can I conceal which account in my database is the admin account, so an attacker won't know which hash to crack first?

Security through obfuscation has limited effectiveness at best - to determine if it is suitable, you need to understand what threats you want to counter. If a threat actor can read your database ...
schroeder's user avatar
  • 130k
26 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

I think the main question here is why string escaping is not as good as the other methods. The answer is that some edge cases allow injections to slip through even though they are escaped. Stack ...
halfer's user avatar
  • 831
23 votes
Accepted

Is deleting files from a database considered a denial of service attack?

Yes, in the sense that anything which "denies service" is a "denial of service". The CIA Triad defines information security as anything which affects Confidentiality, Integrity, or Availability of ...
Mike Ounsworth's user avatar
22 votes

Does password-protecting a database living next to the application add any security?

That is kind of an onion protection (also known as "Layered Security" or "Defense in Depth" as seen, for example, in SANS' "Layered Security: Why It Works" whitepaper). If an attacker can reach the ...
Serge Ballesta's user avatar
22 votes

Storing weakness level of passwords

I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
Kate's user avatar
  • 8,345
21 votes

What's more vulnerable; the data or the DBMS?

No, a database is not always involved. Let's come up with a random service that happens to be moderately popular. A fairly standard set of components includes: a user-facing client (webpage or app) ...
Marc's user avatar
  • 4,301
20 votes

Is using a DB prefix for tables more secure?

No, it's snake oil. When someone finds an SQL injection vulnerability in an application, then not knowing the table names is only a very minor hurdle. Many stock injection payloads (like the good old ...
Philipp's user avatar
  • 49.4k

Only top scored, non community-wiki answers of a minimum length are eligible