Re: Is MD5 still considered safe for storing application user passwords?

On Dec 31, 10:26 am, rich...@xxxxxxx ("Richard Heyes") wrote:
Hi,

Correst me if I'm wrong... but assuming that your salt string is hard coded
into the program, with a MD5 a password + salt is no more secure then a
simple password?

Well if you store the hash by itself, if an attacker gets hold of your
hashes they could be brute forced. However with the addition of a salt
it would be largely pointless since you need both pieces (?) of
information (password plus salt) to generate the hash.

--
Richard Heyes

HTML5 Graphing for FF, Chrome, Opera and Safari:http://www.rgraph.org(Updated December 20th)

It also benefits users that use the same password for multiple sites.
If each site uses a different salt, a collision on one site will not
be a collision on the other sites.
.

Relevant Pages

  • Re: Hidden Application Data
    ... The reason I want to hide the user's credentials is not from the user ... If you must keep things locally then do not store the ... For a new application you should use SHA-256 as the hash. ... cryptographic salt seehttp://en.wikipedia.org/wiki/Salt_. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Confused by salt
    ... I hope someone can help clear my confusion. ... time back that used a hash function to store a password. ... advised me that I really ought to use a salt with this in order to add ...
    (sci.crypt)
  • Re: Is this secure
    ... What I do in my business layer I get the salt, then I use my custom classes ... to hash the passed in password then send the Hash to a Stored Proc to ... Both the hashed password and salt are stored in the database. ... but then i'd need the salt to create a saltedhash to ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Can Kerberos be cracked??
    ... Subject: Can Kerberos be cracked?? ... A "salt" is a "random" value that is appended to the ... possible for you to dictionary-crack my password unless you know the ... >> In order to get the hash you would need to launch a brute force attack ...
    (Focus-Microsoft)
  • Re: Is this secure
    ... I use SHA1 to hash my passwords. ... Both the hashed password and salt are stored in the database. ... but then i'd need the salt to create a saltedhash to compare ...
    (microsoft.public.dotnet.framework.aspnet)