4 ms·
I'm always nervous when people say they've lost "encrypted" passwords. We need a "plain english" version of https://www.owasp.org/index.php/Password_Storage_Che
by lstamour 14y ago
I'm always nervous when people say they've lost "encrypted" passwords. We need a "plain english" version of https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet or at least issue a warning when you create a "password" VARCHAR in MySQL ;-)
- tptacek 14y agoI really hate that OWASP page (it's not as bad as it used to be --- that is, godawful --- and now it's just incoherent) and think we shouldn't be directing developers to it. If there's something "OWASP" (whatever that is) is truly bad at, it's cryptography.
- ineedtosleep 14y agoI usually rely on OWASP for general guidelines, but if that page isn't enough for you, what is? (not a rhetorical question) What should one look into in order to fill in OWASP's gaps?
- gcr 14y agoWhat things would you change?
- gcr 14y agoWhat's wrong with it?
- kijin 14y ago> issue a warning when you create a "password" VARCHAR in MySQL I put my salted and bcrypt'ed passwords in a CHAR or VARCHAR column named "password". Anything wrong with that? Should I change the name of the column to something like "hashed_password"?
- aptwebapps 14y agoThe name of the column isn't a problem, rather it's an opportunity to nudge the developer a bit. Or that's how I read the GP's comment.
- lstamour 14y agoIndeed. It's that even if you store a hash, it might still not follow best practices getting there. Perhaps I should be petitioning sqlite, since it's more of a developer warning than a production one. But really -- it was a joke ;-)