3 ms·
What were they using to hash passwords? sha256? I actually am curious since they didn't mention it in their email.
by swang 4y ago
What were they using to hash passwords? sha256? I actually am curious since they didn't mention it in their email.
- msbarnett 4y ago> The password hashes in this archived data were generated using PBKDF2 or salted SHA1 algorithms previously used by the npm registry. These weak hashing algorithms have not been used to store npm user passwords since the npm registry began using bcrypt in 2017. Which is so frustrating. When you upgrade your hashing algorithm, always always _always_ immediately remediate the weak hash mess by hashing your weak hashes with your new stronger hash, and turn the login check into bcrypt(sha1(user-entered-password)) == stored-bcrypted-sha1 you can then upgrade them to a straight bcrypt if the check succeeds, but keeping the weak hashes on disk indefinitely until the user logs in (if ever!) is such a risk.
- wepple 4y agoI’ve never heard this suggested before. Such a simple elegant solution I’m kinda embarrassed as a security engineer.