4 ms·
Okay I understand this much better now. I was assuming this was about remote access exploit not a local one. Point taken. Use SHA-? instead of MD5.
by mikkom 11y ago
Okay I understand this much better now. I was assuming this was about remote access exploit not a local one.
Point taken. Use SHA-? instead of MD5.
- onion2k 11y agoYep. SHA-256 is a good bet at the moment, or SHA-3 if it's an option.
- franciscop 11y agoNot really, bcrypt is the only bet, SHA-256 is also too fast
- mudetroit 11y agoIf we are going to be correct about this then let's actually be correct and not just say bcrypt is the only bet. You want a system that manages work rate. Off the top of my head that also includes scrypt and pbkdf2.
- franciscop 11y agoThat's right, I wrote what I used in the past
- PeCaN 11y agoNo! Use a proper key-derivation function (bcrypt, scrypt, pbkdf2), not a hash function. SHA family, including the rather unrelated but exceptionally nifty SHA-3 (Keccak), are still hash functions and are still really fast to compute (good if you need to verify the contents of something, bad if you need to store secure information). A decent GPU can still crack SHA hashes effortlessly, and a dedicated attacker will have some good FPGAs (in which case you'll be cracked in hours). Use a function that is meant for storing passwords.
- mikkom 11y ago:-) Bcrypt it is then.