4 ms·
So you mean to say that you store all your users logins with just SHA1, no salt?
by dajonker 9y ago
So you mean to say that you store all your users logins with just SHA1, no salt?
- zie 9y agoLOL. EXACTLY! :) No.. @ password time, we do the normal path PLUS we take the plaintext password, encrypt it with SHA1, see if it's in the pwned database, if it is, warn user. Then we throw the SHA1 away. So sure, it's stored in memory as a SHA1 hash, briefly, but that same memory has the plaintext password...briefly so :) Our normal auth path just attacks AD, so we use AD as the primary store for passwords. After it's been in production for a while, and we see it's still working like gangbusters, then we will turn on that @ password change time, if it's in the DB, we will ban that password from being used. Probably in the next week or two, it depends.