4 ms·

> crypto.createHash('md5').update(password).digest('base64') Any reason you chose md5? Props for at least salting and running it 1000 times.

by dekz 16y ago

jaekwon 16y ago
No, I just wanted a well optimized hash function. Would you suggest another?
- dekz 16y ago
  Certainly would, although SHA1 is being phased out, it's probably still "ok" to use, but I wouldn't choose it if I wanted the project to achieve maximum longevity, I'd choose a later family of SHA, SHA2. It will be slower, but you won't end up looking like gawker. Since node just uses openssl you have quite a collection of message digest algorithms to choose from. Run an "openssl speed" on your server to get a benchmark of different algorithms. Edit: type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes md5 24629.04k 83750.79k 226739.03k 391874.18k 509285.72k sha1 24185.38k 75777.49k 177806.76k 263012.01k 305498.58k sha256 17504.41k 42089.29k 84845.06k 108628.53k 120801.96k sha512 13258.86k 57601.03k 101861.29k 155866.45k 188783.13k Also, you're using iterating 1000 times for all users, you can mix it up and store that with the user in mongo. (1000-1000+). You might also want to serve up your login and any pages requiring some form of authorised behaviours using https. (Prevent auth token theft and password sniffing). Also when validating user input for passwords, are you sure it's isAlphanumeric() that you want? Some users like to have non alphanumeric characters in their passwords. If it's just an attempt to stop xss/injection then I believe node-validator supports that without restricting you to alphanumeric characters only.
- Cherad 16y ago
  You might also consider bcrypt. See: http://news.ycombinator.com/item?id=762708 http://news.ycombinator.com/item?id=762708 For a discussion on it.
  - pluies 16y ago
    Absolutely! http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- michaelbuckbee 16y ago
  I think the general consensus post Gawker hacking was that hashing alone was inadequate and that for greater security you should use bcrypt as it takes so much longer to run attacks.

> crypto.createHash('md5').update(password).digest('base64') Any reason you chose md5? Props for at least salting and running it 1000 times.

by dekz 16y ago

> crypto.createHash('md5').update(password).digest('base64') Any reason you chose md5? Props for at least salting and running it 1000 times.

jaekwon 16y ago

No, I just wanted a well optimized hash function. Would you suggest another?

dekz 16y ago
Certainly would, although SHA1 is being phased out, it's probably still "ok" to use, but I wouldn't choose it if I wanted the project to achieve maximum longevity, I'd choose a later family of SHA, SHA2. It will be slower, but you won't end up looking like gawker. Since node just uses openssl you have quite a collection of message digest algorithms to choose from. Run an "openssl speed" on your server to get a benchmark of different algorithms. Edit: type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes md5 24629.04k 83750.79k 226739.03k 391874.18k 509285.72k sha1 24185.38k 75777.49k 177806.76k 263012.01k 305498.58k sha256 17504.41k 42089.29k 84845.06k 108628.53k 120801.96k sha512 13258.86k 57601.03k 101861.29k 155866.45k 188783.13k Also, you're using iterating 1000 times for all users, you can mix it up and store that with the user in mongo. (1000-1000+). You might also want to serve up your login and any pages requiring some form of authorised behaviours using https. (Prevent auth token theft and password sniffing). Also when validating user input for passwords, are you sure it's isAlphanumeric() that you want? Some users like to have non alphanumeric characters in their passwords. If it's just an attempt to stop xss/injection then I believe node-validator supports that without restricting you to alphanumeric characters only.
Cherad 16y ago
You might also consider bcrypt. See: http://news.ycombinator.com/item?id=762708 http://news.ycombinator.com/item?id=762708 For a discussion on it.
- pluies 16y ago
  Absolutely! http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
michaelbuckbee 16y ago
I think the general consensus post Gawker hacking was that hashing alone was inadequate and that for greater security you should use bcrypt as it takes so much longer to run attacks.