3 ms·

I would say that's not really true. The output hash will look the same if I apply a simple salted SHA-1 with a salt or if I apply 500 MD5's followed up followed

I would say that's not really true. The output hash will look the same if I apply a simple salted SHA-1 with a salt or if I apply 500 MD5's followed up followed up with 200 SHA-1's, each salted differently. I'm not a security expert, but I think this is closer to best practice these days. That said, revealing the exact algorithm would basically be throwing people with weak passwords to the wolves while really only supplying the rest of us with a false sense of security (because it will probably be cracked anyway). We'd also be better off if they didn't announce the algorithm if the passwords get leaked (like with LinkedIn).

gcr 14y ago
For practice, see if you can't identify the hashing algorithm for the following stored passwords: $6$AhHvI8ay$I0ED2wWVU9eheJKvCxzcbc/ZYRoN60q5XNHruYp8yFlQvEOjJ1WtIHUwjG6L4ZGntf3ei8osB7s2GYdkN01gx1 dGhpcyBpcyBzdHVwaWQKCg== 286755fad04869ca523320acce0dc6a4 some_salt:ac01346ad1553221506dd091800a1974 c8fed00eb2e87f1cee8e90ebbe870c190ac3848c 6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e /5L0cR/wpFqSA Note how they don't look the same, so it's quite easy for an attacker to tell the difference. Want to see how you did? Here's the answer key, in base64: MTogTW9kZXJuIGNyeXB0LCBsaWtlIHRoZSBraW5kIHlvdSdkIGZpbmQgaW4gL2V0Yy9zaGFkb3cK MjogSnVzdCBiYXNlNjRpbmcgdGhlIHJhdyBwYXNzd29yZCAoc3R1cGlkKQozOiBVbnNhbHRlZCBt ZDVzdW0KNDogbWQ1c3VtLCB3aXRoIHNhbHQgcHJlcGVuZGVkCjU6IFVuc2FsdGVkIHNoYTFzdW0K NjogVW5zYWx0ZWQgc2hhMjU2c3VtCjc6IE9sZCBVTklYIGNyeXB0KCk=