3 ms·

If they don't store the password encrypted or in plaintext, how would they be able to authenticate you? It must be stored somehow, either plaintext or encrypte

If they don't store the password encrypted or in plaintext, how would they be able to authenticate you? It must be stored somehow, either plaintext or encrypted (preferred).

beatgammit 7y ago
Hashed. An encrypted password can be reversed, a hashed password cannot, it can only be verified. An encrypted password is only slightly preferable to a plaintext one because you still need to store the password somewhere, which am attacker would theoretically have access to, so it mostly serves as obfuscation.
deleted 7y ago
[deleted]
RHSeeger 7y ago
Generally, hashed. Ie, not reversible.
deleted 7y ago
[deleted]
sleepychu 7y ago
There's a difference between encrypted (implies can be decrypted) and hashed (a one way function which cannot be reversed). In general, I shouldn't be able to tell you your password, I should just be able to tell you if the password you just gave me is the one you gave me before.
swebs 7y ago
https://en.wikipedia.org/wiki/Bcrypt https://en.wikipedia.org/wiki/Bcrypt
- lucb1e 7y ago
  I don't know if it is generally discouraged on HN, but let me just say that I find link-only answers discouraging (similar to lmgtfy) and of little value if you don't highlight the important bit. Additionally, your link is about a particular hashing scheme. Someone with no clue what hashing is will not be helped by a link to a particular hashing scheme. The first link in the article, however, gets you to a page that explains everything, and might have been a much better text to cite and link: > Password verification commonly relies on cryptographic hashes. Storing all user passwords as cleartext can result in a massive security breach if the password file is compromised. One way to reduce this danger is to only store the hash digest of each password. To authenticate a user, the password presented by the user is hashed and compared with the stored hash. A password reset method is required when password hashing is performed; original passwords cannot be recalculated from the stored hash value. https://en.wikipedia.org/wiki/Cryptographic_hash_function#Password_verification https://en.wikipedia.org/wiki/Cryptographic_hash_function#Pa...

If they don't store the password encrypted or in plaintext, how would they be able to authenticate you? It must be stored somehow, either plaintext or encrypted (preferred).

beatgammit 7y ago

Hashed. An encrypted password can be reversed, a hashed password cannot, it can only be verified. An encrypted password is only slightly preferable to a plaintext one because you still need to store the password somewhere, which am attacker would theoretically have access to, so it mostly serves as obfuscation.

deleted 7y ago

[deleted]

RHSeeger 7y ago

Generally, hashed. Ie, not reversible.

deleted 7y ago

[deleted]

sleepychu 7y ago

There's a difference between encrypted (implies can be decrypted) and hashed (a one way function which cannot be reversed). In general, I shouldn't be able to tell you your password, I should just be able to tell you if the password you just gave me is the one you gave me before.

swebs 7y ago

https://en.wikipedia.org/wiki/Bcrypt https://en.wikipedia.org/wiki/Bcrypt

lucb1e 7y ago
I don't know if it is generally discouraged on HN, but let me just say that I find link-only answers discouraging (similar to lmgtfy) and of little value if you don't highlight the important bit. Additionally, your link is about a particular hashing scheme. Someone with no clue what hashing is will not be helped by a link to a particular hashing scheme. The first link in the article, however, gets you to a page that explains everything, and might have been a much better text to cite and link: > Password verification commonly relies on cryptographic hashes. Storing all user passwords as cleartext can result in a massive security breach if the password file is compromised. One way to reduce this danger is to only store the hash digest of each password. To authenticate a user, the password presented by the user is hashed and compared with the stored hash. A password reset method is required when password hashing is performed; original passwords cannot be recalculated from the stored hash value. https://en.wikipedia.org/wiki/Cryptographic_hash_function#Password_verification https://en.wikipedia.org/wiki/Cryptographic_hash_function#Pa...