I've been reading up on OWASP 10 and I came across the best practice to store information. Salted hashing. Where you generate one random salt for every password and combing it and hash it and store it. My doubt is, if the salt is generated randomly how the password be authenticated when the user types it? Is the salt saved along with the user name? If so, this practice is still vulnerable. OR how do they do it?
Salted Hash Password Authentication
220 Views Asked by Anon At
1
There are 1 best solutions below
Related Questions in SECURITY
- Can MVC.NET prevent SQL-injection at razor or controller level?
- Forgotten password reset page: should the user need to enter a username/email as well?
- Dynamic roles list in CustomAuthorize ASP MVC
- Access roles from multiple applications
- How to Fix TLS CBC Incorrect Padding Abuse Vulnerability on Windows 2003 Server
- Evernote Web Clipper and Content Security Policy
- Invalidate user credentials when password changes
- Spring Boot MVC non-role based security
- Correct Captcha behaviour on error
- Is macro more secure than static const if I don't want someone to know or change the hardcode value?
- In Android, ensuring only pre-decided users can only use the app
- Authenticating plain text passwords against md5 hash in DB using Apache Shiro
- Symfony2 - handle HTTP/Entity user access restrictions
- Client side computation without exposing code?
- searchable row level encryption using java?
Related Questions in HASH
- Trouble validating md5 hashed password with randomly generated salt?
- Why k and l for LSH used for approximate nearest neighbours?
- PHP password_hash() / bcrypt
- Unique hash/index for time interval
- Order-independent Hash Algorithm
- git hard reset - what am I doing wrong?
- Java HashMap, hashCode() equals() - how to be consistent with multiple keys?
- Create hash from variables in loop
- Hashing integer coordinates of different sizes
- Xcode salting and hashing a password
- Is there a way to generate a Guid from a list of Guids?
- Path reconstruction with Hashing?
- Creating a Hash with keys from an array and empty arrays as the values
- How to read data from a different file without using YAML or JSON
- change value in hash using an array of keys in ruby
Related Questions in PASSWORD-HASH
- Trouble validating md5 hashed password with randomly generated salt?
- How are Joomla 3 passwords encrypted?
- Django Rest Framework - serializer code not executing
- How to verify an hashed password
- Client side password hash versus plain text
- Reset password don't work when login php
- php password_hash and password_verify looked all over still doesn't work
- Check drupal 7 password to C#
- Rfc2898DeriveBytes how to verify the password which is store in database as hash value
- Client or Server side password hashing when a user registers (using HTTP)
- php password_verify doesn't work
- Password does not match with hash algorithm (SQL Server)
- ASP.NET: SHA1 + Salt Password Hashing on Multiple Servers
- Salted Password Validation in PHP
- Hash passwords with bcrypt in the database or in php code?
Related Questions in SALTEDHASH
- Generating Unique Invoice tracking in dot net
- Salted Password Hashing. Am I doing it right in ASP.NET environment?
- One way functions, Hash algorithms
- Trying to understand salting and hashing passwords in Ruby on Rails
- Spring security password hash + salt
- Should I send salt value to web browser to secure password
- Hashing using salt on android and iphone
- PEPPER in a backend Flask app throwing KeyError: 'PEPPER'
- Where to get salt when hashing passwords?
- What is the purpose of the "salt" when hashing?
- how to authentificate user with salt passeword sha-1 with tomcat 7
- Having trouble with apache shiro saltedauthentication.hashProvidedCredentials not given expected hash
- Salted Hash Password Authentication
- data and salt argument with bcrypt
- Unable to login while using salt for password hashing in cakephp3x
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
The salt is saved along with the user name. Salts are not secret. The point of a salt is to ensure that if two people have the same password, they won't have the same hashed password. This prevents pre-computed hash attacks (rainbow tables), and prevents leaking that two users in a database have the same password.
While per-user random salts are ideal, the benefits of salting can also be achieved with deterministic, but unique, salts. For example, you can use some fixed string for your database and join that with the userid (
com.example.mygreatsystem:[email protected]) and use that as the salt. Since it's unique to every user (not just within this system, but globally), it achieves the same goals as a random salt without requiring an extra database lookup. Like with random salts, this scheme does not need to be secret. The important part of a salt is it be unique. But when practical, a per-user random salt of sufficient length (typically 8 random bytes), stored with the user record, is best practice.