passwords | 易学教程

Best PHP hashing method for storing user passwords in a MySQL table?

阅读更多关于 Best PHP hashing method for storing user passwords in a MySQL table?

I've been reading Stack Overflow questions for about 15 minutes now and every single one seems to contradict the previous one I read. Bcrypt, SHA1, MD5, and so on. I currently MD5 my passwords, but I want to make my database more secure in case of a breach. I know this has been asked a million times, but I can't seem to find a decent answer anywhere else. Thanks. The reason you see contradictory answers is because there is no right one. You should use the most secure method that your application can support. More secure = more overhead. MD5 has been broken and cracked. According to this

SAML assertion with username/password - what do the messages really look like?

阅读更多关于 SAML assertion with username/password - what do the messages really look like?

I need to create a some SAML 2.0 assertions, and I'm having trouble finding what the XML should really look like. Most of the documentation seems to be about using particular tools, not about the messages. I've got the schemas, with a plethora of possibilities, but I can't find an example of what the relevant messages actually look like in practice. The business rule says: in order to create a shared identity, the user tells system A their username and password on system B. System A needs to communicate this info (along with some demographics) to system B. System B validates the information

SVN encrypted password store

阅读更多关于 SVN encrypted password store

问题 I installed SVN on a Ubuntu machine and I can't get my head around something. Whenever I checkout something from the terminal I get this error about saving a non-encrypted password: ----------------------------------------------------------------------- ATTENTION! Your password for authentication realm: <[...]> Subversion Repository can only be stored to disk unencrypted! You are advised to configure your system so that Subversion can store passwords encrypted, if possible. See the

Spring Security Custom Authentication and Password Encoding

阅读更多关于 Spring Security Custom Authentication and Password Encoding

问题 Is there a tutorial out there or does anyone have pointers on how to do the following with Spring-Security? Task: I need to get the salt from my database for the authenticating username and use it to encrypt the provided password (from the login page) to compare it to the stored encrypted password (a.k.a. authenticate the user). additional information: I use a custom database structure. A UserDetails object is created via a custom UserDetailsService which in turn uses a custom DAOProvider to

How do you generate passwords? [closed]

阅读更多关于 How do you generate passwords? [closed]

问题 Closed . This question needs to be more focused. It is not currently accepting answers. Want to improve this question? Update the question so it focuses on one problem only by editing this post. Closed 2 years ago . How do you generate passwords? Random Characters? Passphrases? High Ascii? Something like this? cat /dev/urandom | strings 回答1: Mac OS X's "Keychain Access" application gives you access to the nice OS X password generator. Hit command-N and click the key icon. You get to choose

Using Python to authenticate against raw username, hash, salt in DB created by ASP.NET roles/membership

阅读更多关于 Using Python to authenticate against raw username, hash, salt in DB created by ASP.NET roles/membership

We have a current application where user login credentials are stored in a SQL Server DB. These are, basically, stored as a plain text username, a password hash, and an associated salt for this hash. These were all created by built in functions in ASP.NET's membership/role system. Here's a row for a user named 'joe' and a password of 'password': joe,kDP0Py2QwEdJYtUX9cJABg==,OJF6H4KdxFLgLu+oTDNFodCEfMA= I've dumped this stuff into a CSV file and I'm attempting to get it into a usable format for Django which stores its passwords in this format: [algo]$[salt]$[hash] Where the salt is a plain

What is a good way to produce a random “site salt” to be used in creating password retrieval tokens?

阅读更多关于 What is a good way to produce a random “site salt” to be used in creating password retrieval tokens?

问题 I would like to create a site-wide hash to be used as salt in creating password retrieval tokens. I have been bouncing around stackoverflow trying to get a sense of the best way to do this. Here's the reset process: When a user requests a password reset email the code generates a retrieval token: $token = hash_hmac('sha256', $reset_hash* , $site_hash) *$reset_hash is a hash created using phpass HashPassword() function, saved in the user table. I then send the token in a URL to the users email

If I make the SALT random for each user, how do I authenticate them?

阅读更多关于 If I make the SALT random for each user, how do I authenticate them?

I've been reading up on the benefits of salting and hashing passwords, but one thing still eludes me... When I provide a random salt for each user, how do I then know what the salt was when I try to authenticate them to login? so if I do.. HASHPW = PW.RANDOMNUMBER I could store the random number in the database, but that seems to kill the entire point of adding the salt.. doesn't it? I could also use a non random number for each salt, but then that also kills the point of the salt because if they figure it out they have all my users passwords... I just started learning PHP and MySQL and

Password Encryption: PBKDF2 (using sha512 x 1000) vs Bcrypt

阅读更多关于 Password Encryption: PBKDF2 (using sha512 x 1000) vs Bcrypt

问题 I've been reading about the Gawker incident and several articles have cropped up regarding only using bcrypt to hash passwords and I want to make sure my hashing mechanism is secure enough to avoid switching to another method. In my current application I have opted for a PBKDF2 implementation utilising sha2-512 and a minimum of 1000 iterations. Can I ask for opinions on using PBKDF2 vs Bcrypt and whether or not I should implement a change? 回答1: You're good with PBKDF2, no need to jump to

Generate temporary URL to reset password

阅读更多关于 Generate temporary URL to reset password

问题 I am looking to implement a Forgot Password feature on my website. I like the option where an email containing a temporary one-time use URL that expires after some time is sent to the user. I have looked at the following pages to get these ideas but I am not sure how to implement this using ASP.NET and C#. As one of the users indicated, if I can implement this without storing this information inside the database, that will be ideal. Please advise. Password reset by emailing temporary