https://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants
As explained, this information should be easily available on any well maintained system to any competent administrator. Your failure to be able to provide this information leads me to believe you are aware of security flaws in your system and are not prepared to reveal them. Our requests line up with the PCI guidelines and both can be met. Strong cryptography only means the passwords must be encrypted while the user is inputting them but then they should be moved to a recoverable format for later use.
Jump in the discussion.
No email address required.
Alright someone who understands that I haven't studied the security chapters yet explain to me how passwords are stored. Also is the Admin a jeet? I am getting strong jeet energies here.
Jump in the discussion.
No email address required.
You use "hashes". Hashes are "one-way functions" that give you a unique output based on a given input. It changes entirely if there's even a tiny change in the input data.
The other property, and why they are called "one way", is you cannot get the original data back from a hash.
Why this is important to passwords is even in the event passwords are hacked or leaked simple hashing will prevent exposing your actual password. So a website can confirm
hunter 2is your password by comparing the hash it has but a hacker can't turne0fee1adf795c84eec4735f039503eb18d9c35ccintohunter 2.I'm sure some
people here will expand but that's the jist. It also ignores common attacks that are prevented by using special hashes or including "salts" to prevent rainbow table attacks.
Jump in the discussion.
No email address required.
do you mean a hacker can't turn ****** into readable password?
Or that each system has their own code for converting hashes to random gibberish and back to hashes?
Thank you makes sense.
Jump in the discussion.
No email address required.
I put a meme password there but rdrama filters it which is funny.
Jump in the discussion.
No email address required.
hunter2
edit: lol
Jump in the discussion.
No email address required.
very funny
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
Hashes aren't reversible because there's loss of information involved. It's not the same as encryption where all the data is still there in an encoded format. Instead, the hash represents a (hopefully) unique value for any given input. You can't take a hash and figure out what the plain text was that it represents, it's not possible due to the information not really being there anymore.
Nothing to do with *s and stuff, think more like:
Password: mypassword1 -> Hash 123ABC
Password: mypassword2 -> Hash FFFDDD
The hash won't in any way resemble the input, and even closely related input will generate hashes that look nothing like each other.
Jump in the discussion.
No email address required.
it's not so much about losing information (even a truncation achieves that) but rather the preimage resistance/collision resistance properties. Actually, it's obvious that hashes cannot be unique (ie, a hash function is not injective), since the input is arbitrary-length and the output is fixed-length. But the design of hash functions is such that the only known way to find a preimage or collision is to try a large number of inputs.
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
More options
Context
Passwords are stored using an irreversible hash function. When you log in, your input is hashed and compared to the stored hashed value.
Jump in the discussion.
No email address required.
More options
Context
More options
Context