Coding Horror: You're Probably Storing Passwords Incorrectly

http://www.codinghorror.com/blog/archives/000953.html

by luccastera • 19 years ago

32 48 19 years ago

codinghorror.com

chmac• 19 years ago

Great article, some good links, and a damned eye opener. I need to start salting my passwords...

brlewis6• 19 years ago

I need to start using a longer salt and/or a slower hash.

mynameishere• 19 years ago

And I need to come up with a website worthy of someone breaking into.

thomasptacek19• 19 years ago

Salt length and hash speed are orthogonal. Increasing the length of your nonces doesn't make your passwords less crackable. If this is news to you, don't design your own password scheme; use someone else's good one, so you aren't accidentally exposing people's bank accounts.

thomasptacek19• 19 years ago

If you have to reason through or alter what you're currently doing with passwords, it's irresponsible of you to be storing passwords at all. Like it or not, your users are using the same password for your web 2.0 recipe sharing program as they are for their bank account.

Lesson: use someone else's (good) password system.

aston4• 19 years ago

If your bank only uses a username/password combo to confirm your identity online, you need a new bank.

davidw• 19 years ago

> Lesson: use someone else's (good) password system.

Ok, what? I use Ruby on Rails, and I want something open source. What do you recommend?

gwenhwyfaer• 19 years ago

Is there a list of these somewhere? Which ones would you recommend?

bct• 19 years ago

Better yet, use OpenID and let somebody else worry about passwords.

(ok, this isn't an option for everybody yet)

henning• 19 years ago

"most users tend to re-use the same passwords, probably because they can't remember the two dozen unique usernames and passwords they're forced to have. So if you obtain their forum password, it's likely you also have the password to something a lot more dangerous: their online banking and PayPal."

I admit to being somewhat guilty of this, but I'm astonished anyone would use the same password for throwaway email acconts as for financial stuff. I do use only like 2 different passwords for all my stupid little Internet forum accounts, though.

Readmore• 19 years ago

Seriously, people store plain-text passwords? Come on guys, surely you know better than that!

gscott3• 19 years ago

With the exception of the database or backup being 'stolen' wouldn't the addition of a 3rd variable, like a captcha code, solve brute force attacks?

I have been considering implementing something like a captcha code on my login forms (but haven't yet).

jsjenkins1682• 19 years ago

Services like CAPTCHA are intended to solve different problems, like protecting your web service against DoS or bot/spam attacks.

To brute force crack a password, you would really need direct access to the digest. We are talking around the order of 2^80 attempts before finding a collision with a algorithm like SHA-1. Checks need to happen very fast. Doing this through a web interface is already too slow to be feasible from a time perspective.

So really, cracking passwords is only a consideration when someone gets a hold of all your digests (eg. your database) and can crunch away on them locally for a long time.

thomasptacek19• 19 years ago

I'm really not sure you're talking about the same thing as, well, anybody else doing password security. Brute force incremental crackers (read: almost every password cracker ever written) don't attack the algorithmic strength of SHA1. They attack the complexity of the underlying passwords, using dictionaries, mutation functions, and statistics.

SHA1 is strong (at least in this application). Passwords are very, very weak.

thomasptacek19• 19 years ago

Password cracking is an offline attack. If you think the only way you're going to lose your password table is if someone steals a hard drive or a backup, or uses a zero-day to root your whole server, you are making an extemely bad assumption.

gscott3• 19 years ago

Assuming the webserver is not compromised, the sql server is on it's own local network, and the webserver is on both the local network and the Internet accessable network (2 network cards), how exactly does someone get direct access to the sql server to run an offline attack.

I have always assumed the database server is safe there alone on it's own network as long as someone doesn't break into a machine that is connected to that network.

jamongkad• 19 years ago

Good thing I hash my passwords.

joe• 19 years ago

No sir. I be using SHA256 hashes and per-password salts, ever since our site's launch.

ivankirigin• 19 years ago

Django's session/user framework uses a salted hash. Does anyone have any critiques of their method?

Coding Horror: You're Probably Storing Passwords Incorrectly

Related Stories