LinkedIn, eHarmony, and all got their password database leaked on the social Internet inside June. Of numerous commentators opined-a few more lucidly than others-about what is completely wrong and proper and their password-dealing with means. Brian Krebs, whose site is very good reading for anyone looking safeguards, printed an informative interviews with shelter specialist Thomas H. Ptacek.
As testers, how do we evaluate even if our software is dealing with passwords safely? The simplest way to shop passwords is within cleartext, with no security otherwise conversion process of any kind. This approach is both simple and you may unbelievably insecure. Somebody who gets usage of brand new password database-sometimes an executive otherwise a great cracker-quickly knows the latest passwords of the many users.
The next thing right up inside the cover should be to hash the fresh new passwords. An excellent hash setting takes an input (elizabeth.g., „password“) and you will transforms it towards good hash well worth-sort of relatively-arbitrary fingerprint, particularly „b92d5869c21b0083.“ The new hash mode satisfies three extremely important laws:
- An identical type in constantly produces the same hash worthy of-elizabeth.grams., „password“ constantly supplies „b92d5869c21b0083.“
- Any improvement in this new type in provides a volatile improvement in when you look at the the fresh production. Celý příspěvek