Hashing on Rietta Cybersecurity

What is the difference between bcrypt and SHA256?

Fri, 05 Feb 2016 10:23:27 -0500

TL;DR; SHA1, SHA256, and SHA512 are all fast hashes and are bad for passwords. SCRYPT and BCRYPT are both a slow hash and are good for passwords. Always use slow hashes, never fast hashes.

SANS’ Securing Web Application Technologies [SWAT] Checklist is offering a bit of bad security advice for the everyday web application developer, under the heading “Store User Passwords Using A Strong, Iterative, Salted Hash”:

User passwords must be stored using secure hashing techniques with a strong algorithm like SHA-256. Simply hashing the password a single time does not sufficiently protect the password. Use iterative hashing with a random salt to make the hash strong.

Really Bad Passwords (with Unsalted Hashes)

Fri, 08 Jun 2012 18:30:00 +0000

The June, 2012, LinkedIn password breach reminds us all the need to protect our user’s passwords. The following table includes a series of really, really bad passwords. These are passwords that are trivially cracked using an automated tool, such as John the Ripper, or have been found through public password hacks as being in use by real people. This is a simple rainbow table because it lists the precomputed unsalted SHA1 and MD5 hashes.

Authentication Without Encryption for Ham Radio

Mon, 17 Aug 2009 00:00:00 +0000

In April 2004, I gave a talk for the Atlanta Radio Club about the possibilities for authenticated digital communication for amateur radio applications. I published the document on my Georgia Tech website at that time. Since I no longer have an account at Georgia Tech, I am re-posting the document here. Authenticating on a Ham Internet The FCC regulations for amateur radio, part 97, rule that encryption cannot be used to obscure the meaning of communications.