Password Security The Right Way
stormpath.com
Password Security The Right Way
1–10 of 50 posts
Re: Password Security The Right Way
#2[deleted]
Re: Password Security The Right Way
#3No.
http://codahale.com/how-to-safely-store-a-password/
It's really not more complicated than this. You can use scrypt instead of bcrypt if that makes you happy. The secret crypto keys in separate storage locations stuff is silly. Get the basics right.
Re: Password Security The Right Way
#4No. http://codahale.com/how-to-safely-store-a-password/ It's really not more complicated than this. You can use scrypt instead of bcrypt if that makes you happy. The secret crypto keys in separate storage locations stuff is silly. Get the basics right.
Totally agree Coda gets the basics right and I love that article. In fact, our CTO wrote a response blog article to that in February: http://www.stormpath.com/blog/strong-password-hashing-apache...
However, to quote from that post: "The author is correct assuming the attacker has direct access to your password store. This is a big assumption - most organizations go through great lengths to ensure access to say, databases, is levels of security 'deep' beyond just a web login form. Anyway, assuming that this might ever happen to you, how can you address the issue?"
Re: Password Security The Right Way
#5No. http://codahale.com/how-to-safely-store-a-password/ It's really not more complicated than this. You can use scrypt instead of bcrypt if that makes you happy. The secret crypto keys in separate storage locations stuff is silly. Get the basics right.
Totally agree Coda gets the basics right and I love that article. In fact, our CTO wrote a response blog article to that in February: http://www.stormpath.com/blog/strong-password-hashing-apache... However, to quote from that post: "The author is correct assuming the attacker has direct access to your password store. This is a big assumption - most organizations go through great lengths to ensure access to say, datab…
Iterated SHA2 is inferior to bcrypt and far inferior to scrypt, and yet both these Stormpath.com articles recommend it. The advice in these articles is worse that Coda's articles; developers should read Coda's post and implement it.
Re: Password Security The Right Way
#6The hey girl crap needs to end. Now.
Re: Password Security The Right Way
#7Earlier quoted context omitted.
Totally agree Coda gets the basics right and I love that article. In fact, our CTO wrote a response blog article to that in February: http://www.stormpath.com/blog/strong-password-hashing-apache... However, to quote from that post: "The author is correct assuming the attacker has direct access to your password store. This is a big assumption - most organizations go through great lengths to ensure access to say, datab…
Iterated SHA2 is inferior to bcrypt and far inferior to scrypt, and yet both these Stormpath.com articles recommend it. The advice in these articles is worse that Coda's articles; developers should read Coda's post and implement it.
You're talking about Bcrypt like its some magical golden unicorn that will cover your ass from all attack vectors. Sure, its awesome. But modern security requires more than just an awesome encryption algorithm.
Re: Password Security The Right Way
#8I would be very skeptical about dealing with this company...
Level 2 ask for a CSPNG to be used to generate the salt. Why? Given that the salt is assumed to be a piece of public knowledge when attacking a system like this there's no need for it to be output from a CSPNG as there's no concern about a random number generator weakness as an attack vector.
Level 3 it's not clear if bcrypt/scrypt are used or just some SHA iterations. There's a difference between the two.
Levels 4 and 5 don't seem to provide much additional security over getting the hashing right. Also, there's an awful lot of 'we do secret stuff' that worries me.
And specifically the claim in part 5 that all the stores would have to be compromised seems erroneous to me. Suppose I compromise one store and I have part of the hash, I can still run a password cracker and compare with part of the hash I have. Sure, there's some error there but I can then take the guessed password and try it to see if I got it right.
Re: Password Security The Right Way
#9Earlier quoted context omitted.
Iterated SHA2 is inferior to bcrypt and far inferior to scrypt, and yet both these Stormpath.com articles recommend it. The advice in these articles is worse that Coda's articles; developers should read Coda's post and implement it.
You're talking about Bcrypt like its some magical golden unicorn that will cover your ass from all attack vectors. Sure, its awesome. But modern security requires more than just an awesome encryption algorithm.
No, I'm talking about bcrypt like it's better than iterated SHA2, which is very, very fast on GPUs. There is no such thing as a unicorn.
Re: Password Security The Right Way
#10No. http://codahale.com/how-to-safely-store-a-password/ It's really not more complicated than this. You can use scrypt instead of bcrypt if that makes you happy. The secret crypto keys in separate storage locations stuff is silly. Get the basics right.
Totally agree Coda gets the basics right and I love that article. In fact, our CTO wrote a response blog article to that in February: http://www.stormpath.com/blog/strong-password-hashing-apache... However, to quote from that post: "The author is correct assuming the attacker has direct access to your password store. This is a big assumption - most organizations go through great lengths to ensure access to say, datab…
Assuming the attacker has access to your password store is NOT a big assumption for most sites. In fact, 94% of data breaches are to the user DB. And 42% of those attacks are targeting the password store specifically. Check out the Verizon Data Breach Report for details. http://bit.ly/GFfpdk