5 ms·
Have they did a bcrypt(password + userId + username), it won't be so bad. Order of entropy is important. Also I'm not sure what functionality the authenticatio
by ww520 2y ago
Have they did a bcrypt(password + userId + username), it won't be so bad. Order of entropy is important.
Also I'm not sure what functionality the authentication cache provides, but their use of bcrypt(userId + username + password) implies the password is kept around somewhere, which is not the best practice.
OT. Has Argon2 basically overtaken Bcrypt in password hashing in recent years?
- buzer 2y ago> Have they did a bcrypt(password + userId + username), it won't be so bad. Order of entropy is important. That depends on how exactly it was used. If it was simply used to check if previous authentication was successful (without the value containing information who it was successful for) then single long password could be used to authenticate as anyone.
- ww520 2y ago> single long password could be used to authenticate as anyone. Only if everyone uses the same long prefix for password.
- buzer 2y agoNo. If the value of the cache key is simply true/false then someone would first login to their own account using the long password. This would result in storing: bcrypt(longpassword + 123456 + me@foobar.com) = bcrypt(longpassword) = hash1 -> true If they then try login as you@bar.com using same password there would be a cache lookup: bcrypt(longpassword + 1111111 + you@bar.com) = bcrypt(longpassword) = hash1 -> true