3 ms·
Redux: Are you sure SHA-1+salt is enough for passwords?
- Sami_Lehtinen 14y ago"And this is the assumption any security design should be based on; an attacker has access to everything that is on the server. " 1. So passwords aren't meaningful at that point anymore anyway. Who cares about passwords, if attackers already got full administrative/root access? 2. They also can modify authentication code so that it stores plaintext passwords when who ever logs in. - But as saod this is absolutely pointless due first point.
- shane_armstrong 14y agoI currently use bcrypt(md5(sha256(md5(sha256(md5(sha256(md5(sha256(md5(sha256(md5(sha256(md5($pass, $salt1), $salt2), $salt3), $salt4), $salt5), $salt6), $salt7), $salt8), $salt9), $salt10), $salt11), $salt12), $salt13), $salt14) and I still get paranoid my users security.