5 ms·
Half the problem is that quite a few standards/compliance groups don't impose the right requirements. PCI audits used to just check for "encrypted passwords."
by owenmarshall 12y ago
Half the problem is that quite a few standards/compliance groups don't impose the right requirements. PCI audits used to just check for "encrypted passwords."
OWASP does make a decent recommendation, maybe that'll help give you a leg to stand on:
https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Impose_infeasible_verification_on_attacker https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet...
- Alupis 12y ago> PCI audits used to just check for "encrypted passwords. PCI is a joke. The self-fill audit: "Are you secure?" -- Uh... sure? The various scanning companies are of differing quality too, adding to the difficulty in getting any real security improvements from the standard across all ecommerce shops.
- sarciszewski 12y agoAFAIK, PCI is an unfunny joke. This is why my pentester friends have told me about it: > Release v1.0 of super cool app. > v1.0 gets PCI certified > Someone discloses a vuln in v1.0 > Release v1.1 > Companies are stuck with v1.0 for at least 90 days until v1.1 can be certified