3 ms·
SHA1 is a hashing algorithm (as opposed to an encryption algorithm), this means the string you're trying to hash will always have the same result. As an example
by joaodlf 10y ago
SHA1 is a hashing algorithm (as opposed to an encryption algorithm), this means the string you're trying to hash will always have the same result. As an example, the string "password" will always have the same SHA1 hash (5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8). If you have the list of hashes, you can always find a lot of the passwords by using the techniques explained above.
- truth_sentinell 10y agoOh ok, I guess this doesn't happen with bcrypt, right? Because it spits out a different hash every time you hash it.
- gruturo 10y agoUh? Of course not. It will spit out exactly the same hash every time, given the same input. How else would you verify that the password matches ?
- truth_sentinell 10y agoI don't know. Laravel uses a hash algorithm that uses bcrypt and never outputs the same hash.
- nommm-nommm 10y agoBcrypt uses 22 character salt. The output of your library's BcryptEncoder.encode(password) includes not only the password hash but information about the algorithm and the salt. That's what you store in your database. That extra information tells the decode function how to decode later on. See here: http://stackoverflow.com/questions/6832445/how-can-bcrypt-have-built-in-salts http://stackoverflow.com/questions/6832445/how-can-bcrypt-ha...
- nommm-nommm 10y agoTry it, it doesn't. The Bcrypt algorithm generates salts and the salt is built into the outputted hash.