5 ms·
Good summary: https://twitter.com/PwdRsch/status/1103021803503607808 https://twitter.com/PwdRsch/status/1103021803503607808 > Researchers asked 43 freelance de
by gregmac 8y ago
Good summary: https://twitter.com/PwdRsch/status/1103021803503607808 https://twitter.com/PwdRsch/status/1103021803503607808
> Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext.
> Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developers:
> 10 - MD5
> 8 - Base64
> 7 - Bcrypt
> 5 - SHA-256
> 5 - PBKDF2
> 3 - AES
> 3 - 3DES
> 1 - SHA-1
> 1 - HMAC/SHA1
> only 3 of 17 participants, who used other hash algorithms, implemented salting. One of them generated a random salt, one made use of the username, and one hard-coded a static salt
As an industry, we (developers) have a long way to go.
- PostOnce 8y agoMaybe the segment of in the industry in which the cheapest outsourced devs work, anyway. Their conclusion states as much (hiring more expensive devs on freelancer.com got them more secure solutions): "In addition, we found a significant effect in the freelancers’ acceptance rate between the €100 and €200 conditions for the prompted task and examined the effect of different payment levels on secure coding behavior. We saw more secure solutions in the €200 conditions, although the difference was not statistically significant. However, this result might be due to the small sample size and we believe this is worth following up in future work."
- penagwin 8y agoThey also state it's not statistically significant :P (Although I agree that seems likely because of the sample size)
- Ayesh 8y agoI am freelancing on my 10th year now (never set foot in an office to work), and let me tell you hiring people on freelancer.com, no matter how much the budget is, won't end up good. Fiver and freelancer.com has the worst kind of freelancers in my experience.
- penagwin 8y agoIt's insane to me that it's not "common knowledge" to AT LEAST hash the passwords. It's also interesting because 6 used an encryption algorithm, 10 used MD5 which is as good as plaintext nowadays IMO, and 8 used Base64, so even though 24 people thought they "secured it" the passwords are trivial to recover.
- thaumasiotes 8y agoMD5 is a little better than plaintext. Difficult passwords are still difficult when you know their MD5 hash. Base64... is actually plaintext; that's much, much worse.
- penagwin 8y agoYeah MD5 is better to a degree, although 5f4dcc3b5aa765d61d8327deb882cf99 is still the most common password (md5 hashed) hehe :P
- ecesena 8y agoTo play devil’s advocate, to me plaintext means I want to finish quickly because you haven’t asked and are paying too little, while any solution other than bcrypt/pbkdf2 means I don’t know what I’m doing.
- woah 8y agoHow much time does it take you to drop in bcrypt?
- blotter_paper 8y agoHaving once run my own freelance web dev company, I feel very comfortable saying that I would not take a project where I wasn't getting paid enough to bother hashing passwords. That's beyond justification. Either reject the client or protect their users.
- Ayesh 8y agoThis should be part of the job, no matter how tight the budget is. Password hashing is quite accessible in almost every language and I can't think of any excuse not to hash passwords.
- hardwaresofton 8y agoI'm curious as to why they only said 3 of 17 used salt -- most bcrypt implementations will automatically generate a random salt (since the salt is visible in the generated hash), and 7 people used bcrypt? Literally bcrypt and you're done (for now).
- blotter_paper 8y ago> only 3 of 17 participants, who used other hash algorithms, implemented salting. Emphasis added.
- hardwaresofton 8y agoahhh thank you I did not read closely enough