Join me on my quest to seek out and destroy weak passwords and weak password storage everywhere!
With PBKDF2/RFC2898/PKCS#5v2, BCrypt, and Scrypt, sufficiently long cryptographically random per-user salts, and iterations in the tens of thousands or sufficiently high work factors we will defeat the lesser foe, weak password storage!
With education, sufficiently large keyspaces, nigh-unlimited maximum lengths, sufficiently long minimum lengths, and rules-based dictionary lookup exclusions, in time we will defeat the even more fearsome enemy of the weak password itself!
Member for 6 years, 9 months
11 profile views
Last seen Feb 7 '18 at 5:13
- Information Security 9.5k 9.5k 22 gold badges2020 silver badges4848 bronze badges
- Stack Overflow 2.4k 2.4k 1515 silver badges2222 bronze badges
- Database Administrators 1.5k 1.5k 88 silver badges1212 bronze badges
- Super User 491 491 33 silver badges1010 bronze badges
- Code Review 183 183 11 silver badge66 bronze badges
- View network profile
Top network posts
- 108 Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
- 101 Will typing my password twice make it more secure? Or typing each character twice?
- 49 What's the difference between HMAC-SHA256(key, data) and SHA256(key + data)
- 43 Is using SHA-512 for storing passwords tolerable?
- 37 Is there an encryption algorithm that is fully secure?
- 27 Recommended ssl_ciphers for security, compatibility - Perfect Forward secrecy
- 23 Parameters for PBKDF2 for password hashing
- View more network posts →