“Website Passwords Hacked” headlines can be less scary

#1

Post by privasectech » Wed, Nov 20, 2013, 7:56 PM UTC

“Website Passwords Hacked” headlines can be less scary
privasectech.com

Re: “Website Passwords Hacked” headlines can be less scary

#2

Post by mschuster91 » Wed, Nov 20, 2013, 8:03 PM UTC

You totally forget about hash salting - this way a hacker can't use rainbow tables or precomputed hashes for common passwords.

Re: “Website Passwords Hacked” headlines can be less scary

#3

Post by dxm » Wed, Nov 20, 2013, 8:35 PM UTC

  The two most common methods, md5 and sha-1 are
  both susceptible to collisions, or birthday attacks.
  As of writing this, I would recommend using
  SHA-3-256 which has no known attacks.

Don't do that. Hashing algorithms without salt and iteration counts is a bad idea. Thankfully, languages and frameworks are starting to take this responsibility away from the programmer (or at least they're making it easier) – consider using has_secure_password in Rails, password_hash in PHP 5.5, etc. Don't use standard hashing algorithms.

Re: “Website Passwords Hacked” headlines can be less scary

#4

Post by iLoch » Wed, Nov 20, 2013, 8:50 PM UTC

mschuster91 wrote: post #2

You totally forget about hash salting - this way a hacker can't use rainbow tables or precomputed hashes for common passwords.

I've also seen a fair bit of misunderstanding about hashes - you do not want to apply a global salt to all your hashes. Salts should be generated on a per hash basis, and should be stored within the hash itself. Most hashing libraries will do this. It's usually much easier and safer to use a library than to roll your own.

Re: “Website Passwords Hacked” headlines can be less scary

#5

Post by privasectech » Wed, Nov 20, 2013, 9:23 PM UTC

mschuster91 wrote: post #2

You totally forget about hash salting - this way a hacker can't use rainbow tables or precomputed hashes for common passwords.

Thanks for this! I have added a paragraph on salting if you reload the page.

Re: “Website Passwords Hacked” headlines can be less scary

#6

Post by privasectech » Wed, Nov 20, 2013, 9:24 PM UTC

dxm wrote: post #3

The two most common methods, md5 and sha-1 are both susceptible to collisions, or birthday attacks. As of writing this, I would recommend using SHA-3-256 which has no known attacks. Don't do that. Hashing algorithms without salt and iteration counts is a bad idea. Thankfully, languages and frameworks are starting to take this responsibility away from the programmer (or at least they're making it easier) – consider us…

Thanks! I have updated the article to include a paragraph on salting.

Re: “Website Passwords Hacked” headlines can be less scary

#7

Post by mschuster91 » Wed, Nov 20, 2013, 9:56 PM UTC

iLoch wrote: post #4

mschuster91 wrote: post #2

You totally forget about hash salting - this way a hacker can't use rainbow tables or precomputed hashes for common passwords.

I've also seen a fair bit of misunderstanding about hashes - you do not want to apply a global salt to all your hashes. Salts should be generated on a per hash basis, and should be stored within the hash itself. Most hashing libraries will do this. It's usually much easier and safer to use a library than to roll your own.

Indeed, yes, and I do this for all my projects. But even a global salt is way better than no salt at all.

That aside, doesn't Wordpress still use lots of global salts?!