php - Does rehashing a randomly salted password at login increase security? -

-

i working on project in php, , wondering how make system secure possible. using password_hash hash passwords , store them in database. wondering: rehashing , re-saving new salted hash database increase security, or illusion?

i don't think increase security, no. have 2 risk scenarios:

  • the cracker breaks server , stays there time undetected. in case, passwords can captured programmatically, users log in. requires less effort brute-forcing strong hash algorithms.
  • the cracker breaks in, steals copy of database, , in response sysadmin plugs security hole , restores server backup quickly.

in second case, cracker has set of usernames, email addresses , hashed passwords, may wish try brute-forcing. there no advantage had if these hashes created once or thousand times.

it's worth remembering we're trying guard against here. if security of website has been breached, there knock-on effect users have used same username/password combination @ other popular services. major reason hashing, , purpose attacker has in brute-forcing passwords, see if users can hacked elsewhere (for example social media or bank accounts).

this why recommend people should not re-use passwords, , instead should use strong passwords stored in password manager. better if people can use different username and/or different email per service. incidentally, surprisingly easy use email per service: if on gmail address of gmail.alias@gmail.com, this:

gmail.alias+randomcode@gmail.com

the email should of course stored in password manager - if forget this, not able use password reminder features, , locked out unless service willing accept other proof of identity. despite that, approach stronger against ripple effect of using service breached - weak password reminder system elsewhere harder exploit if users use different email addresses.

users own domain name can similar - set email account "catch all" , use whatever aliases like.


Comments

Post a Comment

Popular posts from this blog

python - pip install -U PySide error -

-
does know how avoid following error when running pip install -u pyside per official website instructions here: https://pypi.python.org/pypi/pyside/#installing-pyside-on-a-mac-os-x-system note have done brew install qt successfully. you using pip version 7.0.3, version 7.1.2 available. should consider upgrading via 'pip install --upgrade pip' command. collecting pyside using cached pyside-1.2.4.tar.gz installing collected packages: pyside running setup.py install pyside complete output command /applications/anaconda/bin/python -c "import setuptools, tokenize;__file__='/private/var/folders/dy/ttgqhqqx3g9bsbsnqnxsk2z80000gq/t/pip-build-cpxemt/pyside/setup.py';exec(compile(getattr(tokenize, 'open', open)(__file__).read().replace('\r\n', '\n'), __file__, 'exec'))" install --record /var/folders/dy/ttgqhqqx3g9bsbsnqnxsk2z80000gq/t/pip-0r7hri-record/install-record.txt --single-version-externally-managed --compile: ...
Read more

arrays - C++ error: a brace-enclosed initializer is not allowed here before ‘{’ token -

-
simple question: i'm trying initialize array within c++ class declaration: using namespace std; #include <string> class myclass{ public: string myarray[] = {"a","b","c"}; }; and i'm getting error: error: brace-enclosed initializer not allowed here before ‘{’ token no, without complied c++11 compiler, cannot initialize member array in declaration. have initialize array member in constructor. , don't use open array if know number of elements initialize array.
Read more

cytoscape.js - How to add nodes to Dagre layout with Cytoscape -

-
i trying add nodes dagre graph through cityscape.js. problem nodes not painted. code have: cy.add({ group: "nodes", data: { id:"n0",name:"n0",weight: 75 }, }); $.ajax(url).done(function(jsontree){ var newnodes=[]; for(var i=1;i<6;i++){ //var child = jsontree.result[i]; newnodes.push( { group: "nodes", data: { id: "n"+i, name:"n"+i}}, { group: "edges", data: { id: "e"+i, source: "n0", target: "n"+i } } ); } cy.add(newnodes); any ideas? have used loaded function reload graph not work. not know if have use specific function reload graph. thank in advance. you need add positions new nodes. cytoscape.js docs : it important note positions of newly added nodes must defined when calling cy.add(). nodes can not placed in graph without valid position — otherwise not displayed. yo...
Read more