Is it normal for people to think storing passwords by encrypting them with AES-256 is better than storing them hashed?
I asked a vendor to fix up their DES-based (or possibly homebrew) password storage by switching to SHA-256 and adding salts. They triumphantly responded that the next version will include AES-256 encryption.
I mean, I guess it's better, but I'm a little puzzled at the choice
Reminds me of my Security+ teacher who was like, "Yeah, some places make you use MD5 for passwords, but on my personal systems I use AES to store passwords because AES is AWESOME!!"
SHA-256 is still not great, but it's better than encryption which misses the whole point: so that passwords aren't recoverable.
@FireQuacker Hopefully that conversation was like a decade ago, because that's about how far back you would have to go to reach a point in time where suggesting MD5 for passwords was at least not a terrible idea...
@FireQuacker But is it normal for people to think that? Hopefully not, since hashing has been the standard for sooooo long. Are there still a lot of people who don't understand the issue though? Absolutely.
I actually just found this gem in some open source ecommerce software:
$customer_query = $this->db->query("SELECT * FROM " . DB_PREFIX . "customer WHERE LOWER(email) = '" . $this->db->escape(utf8_strtolower($email)) . "' AND (password = SHA1(CONCAT(salt, SHA1(CONCAT(salt, SHA1('" . $this->db->escape($password) . "'))))) OR password = '" . $this->db->escape(md5($password)) . "') AND status = '1'");
The only thing that would make it worse is if they didn't include the $this->db->escape. They have both a homebrew hash aglorithm based on SHA1AND MD5, all rolled into one!
Escape is a simple wrapper around mysql_real_escape_string. That thing was supposed to die a decade ago...
@ThoriumBR Chamber empty, mag on the night stand, gun on safe
@FireQuacker As much as we might hate it, having recoverable password may be a business requirement
Or more like "Our IT is used to being able to click a button and e-Mail a customer/employee/etc their password and they don't want their workflow to change"
I like to use the following analogy:
> Storing your passwords with AES is like writing them down on a piece of paper, then locking it in a box, and hiding the key in your room. > Storing your passwords with SHA-256 is like writing them down on a piece of paper, then storing it in a box, locking it and throwing the key away.
> Now sure, you may be sure you have a good hiding spot for that key, but not having a key always beats that.
> all this has zero value for average users that only need to know YES or NO whether a PDF is dangerous... average users are not interesting in dissecting files.
> this is yet another example of elitarian attitudes ("we know, we don't care if you can't use our tools"). PLEASE HELP the average user. write a (Python) app that reads a list of PDF files and returns whether which ones are dangerous...
I love the tone in which he demands us to write an application that does what he wants to do. I can't help but feel very strong distaste for such people
@MechMK1 Clearly he missed the fact that giving a YES/NO answer on whether or not a PDF is dangerous is near impossible... but sure, I'll go do that in my spare time, and after I've done that I'll go ahead and solve the halting problem too...
I really can’t figure how they do it and hope someone can help figure it out. I want to write a blocker extension program to my operating system or browser if they are the source of the problem.
My old email (exposed during the LinkedIn data breach) would receive spam emails related to my search ...
