541–550 of 596 posts
Earlier quoted context omitted.
He doesn't need to memorize it. He mentioned he used 1Password to generate it. I'd assume he's storing it there too.
I've always wondered when 1Password is going to get hacked..
there's a couple of things that these major providers getting pwned teaches you: 1) their security isn't good just because of their scale/size (that begins to seem more and more like a false-assumption nowadays) 2) migrating your email to a new provider is quite difficult (consider that the average person will have just 1 - or 2 - email accounts and they link EVERYTHING to it) 3) the price of ads/convenience is no lo…
Migrating e-mail is very difficult, especially if you're like me and decide to setup your own e-mail server. The biggest problem I had was my e-mail getting falsely classified as spam: http://penguindreams.org/blog/how-google-and-microsoft-made-... I've also occasionally found really old services that use my old e-mail account. Even thought I have the password, they still require e-mail verification; which can't be d…
Earlier quoted context omitted.
That's just a bug. Truncation invalidates the 'stored properly' part of the statement.
Could you expand on that? I did not think bcrypt was responsible for storing the resultant hash. The limit appears to be in calculating the hash.
Earlier quoted context omitted.
leaking unsalted md5 passwords == leaking passwords
MD5 is terrible for human passwords because it's fast. But md5 is not actually broken for password storage purposes. If you use a long random password, md5 is enough.
nothing
While i was new to programming and i read some articles about why not to store password in clean text, a google was enough to taught me about blowfish algorithm and the concepts of higher costs hashing benefits! Well my life first program was more secure then Yahoo i guess, storing password in MD5 too bad Yahoo...
DO NOT delete your Yahoo account! In their disclaimer when you delete it, they state: > "[...] we may allow other users to sign up for and use your current Yahoo! ID and profile names after your account has been deleted" Bummer if you forget that it was the password reset email for your Facebook account, huh? Instead of deleting your account, purge it of all data: https://honeypot.net/purge-your-yahoo-account/
Earlier quoted context omitted.
I think it's best to allow longer passwords for those who use long phrases. It's easier to remember the full phrase than a truncated version. You could show a warning that the extra chars beyond 50-55 will be ignored.
Or you could SHA256 the original password and feed the hash to bcrypt. Remember to use the 64-byte hexadecimal hash, not the 32-byte binary because bcrypt chokes on null bytes. Everyone's been saying "just use bcrypt", but bcrypt has too many gotchas to be the default choice. We really need to work on getting scrypt and argon2 into the most popular programming languages and frameworks a.s.a.p.
I haven't looked deeply at this, but using "key stretching" that clips your output characters to such a small space smells very suspect to me.
Remember: there is only 32 bytes of actual output there, regardless of whether you represent it as hex or binary. And since bcrypt can't take more than 56 bytes of input, you are clipping that down to the equivalent of 23 bytes.