Password Hashing on Rietta Cybersecurity

Bad Password Practices are Responsible For Most Data Breaches. You Can do Better.

Tue, 10 May 2016 11:07:58 -0400

The 2016 Verizon DBIR report is out and is available for download. Among the findings is the prevalence of data breaches that are attributable to stolen authorization credentials.

According to the report “63% of confirmed data breaches involved weak, default or stolen passwords” (page 20). This is an increase from 2015, when the stat was that 51% of web application breaches were attributable to stolen credentials. If anything is clear, it’s that the lowly credential theft is a clear and present danger in information security. It is responsible for more incidents than all the other exotic, technically interesting attacks combined.

What is the difference between bcrypt and SHA256?

Fri, 05 Feb 2016 10:23:27 -0500

TL;DR; SHA1, SHA256, and SHA512 are all fast hashes and are bad for passwords. SCRYPT and BCRYPT are both a slow hash and are good for passwords. Always use slow hashes, never fast hashes.

SANS’ Securing Web Application Technologies [SWAT] Checklist is offering a bit of bad security advice for the everyday web application developer, under the heading “Store User Passwords Using A Strong, Iterative, Salted Hash”:

User passwords must be stored using secure hashing techniques with a strong algorithm like SHA-256. Simply hashing the password a single time does not sufficiently protect the password. Use iterative hashing with a random salt to make the hash strong.

Really Bad Passwords (with Unsalted Hashes)

Fri, 08 Jun 2012 18:30:00 +0000

The June, 2012, LinkedIn password breach reminds us all the need to protect our user’s passwords. The following table includes a series of really, really bad passwords. These are passwords that are trivially cracked using an automated tool, such as John the Ripper, or have been found through public password hacks as being in use by real people. This is a simple rainbow table because it lists the precomputed unsalted SHA1 and MD5 hashes.

Web Application Security & Performance

Tue, 22 Sep 2009 17:07:00 -0500

As a business owner or manager, you need to be aware of the main legal liability and technical challenges that face any critical website or application. Your business will be better positioned to succeed if you understand how to answer these five key questions: Is your business making one or more of the top five web application mistakes that generate business risk? How can performance and security assessments help increase your ROI?