The Stack Overflow podcast is back! Listen to an interview with our new CEO.
4

Say I'm using Argon2(di) to store passwords. Should I use the second method or first method to hash passwords? No. Argon2 takes the salt as a separate argument from the password, and takes responsibility internally about how to incorporate them both into the computation. As any specialized password hashing function should. Ideally, though, you should use ...


3

Pretty much all of my answer is based off of my own interpretation of the results from this paper: https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0041531 (aka, I'm not an expert in how the human brain works and I haven't done tons of research). I'll start with the most important detail and then answer your question Under realistic ...


2

For the specific scenario you outline (theft of your computer or hard disk), that will probably work. Note that EFS is based on your Windows password, and Windows' password hashing is incredibly weak by modern standards, so your password will need to be extremely good to prevent a dedicated attacker from brute-forcing the hash. Additionally, EFS provides ...


2

Well, first and foremost, check you are hashing and salting the password correctly. It is a lot more critical if the hash is available more easily to attackers. Also keep in mind that even correct hashing can't protect short passwords from determined attackers. Second of all, if you are using this hash to the authenticate to the online server, you should be ...


2

If I understand correctly, PHP is only ever executed server side. If I’m correct in that, then high value user secrets are going to be transmitted to your server even if encrypt them right after you get them. At this point I should disclose that I work for a popular password manager, but I’m not trying to discourage competition. But I do recommend that you ...


2

Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? Absolutely not. There are two primary problems which make the risk (likelihood x impact) of an attack high: The first is that you are likely underestimating likelihood: It is very hard to keep something a secret in your own ...


1

Regarding the issue mentioned by Adi about passwords being stored in plain text, it's good to know that since version 3.26.0-rc1 (2017-05-25), FileZilla has support for encrypted passwords protected by a master password. Hence, there is no reason to say that FileZilla is less secure than other FTP clients. See developement diary entry. To change that ...


Only top voted, non community-wiki answers of a minimum length are eligible