26/43 freelancers chose “plaintext” to store passwords(twitter.com)

26/43 freelancers chose “plaintext” to store passwords

https://twitter.com/PwdRsch/status/1103021803503607808

6 comments

nwrk7 anni fa

Seen many specifications when security is NOT required and/or client don't want to pay for it / don't care.

Security comes with cost and effort.

*Researchers asked 43 freelance developers to code the user registration for a web app

He get what he exactly asked for.

nobrains7 anni fa

The right approach from the developers who decided to store text as plain text, would have been to highlight this to the requestor, and indicate that it would cost extra. More business for them, and better end result for the requestor.

offbytwo7 anni fa

What's the industry 'standard' nowadays? I assume SHA-256 would be decent but I don't really keep up with that stuff.

magnetic7 anni fa

I don't know what the industry actually does, but what it should probably do is use bcrypt.

https://en.wikipedia.org/wiki/Bcrypt

marpstar7 anni fa

On a project I started last year, I used SHA512 (probably overkill but who cares) and then bcrypt. Allows users to have passwords of arbitrary size with the goodness of bcrypt.

Then AES256 the result and use that. I read somewhere that's what Facebook does.

cjcampbell7 anni fa

While somewhat better than plaintext, SHA-256 is far too easy/fast to slow down dictionary attacks.

Practically speaking, the best practice is to use a previously vetted library that provides high-level password storage solutions based on the recommendations below. Developers should not be reinventing the wheel to solve these problems for each job.

Having said that, here are the main factors:

- Choose a function that's designed to be slow to compute (and preferably that can't be easily optimized by throwing memory at the problem). Bcrypt, scrypt, and pbkdf2 are the most common solutions. Argon2 was the winning candidate of the 2013 - 2015 password hashing competition and is gradually starting to appear in more places.

- In addition to choosing the right function, hashes should be salted with a random value (that's stored with the hash) to prevent pre-computation and attacking multiple hashes in parallel.