It seems like every week there’s a report of another security intrusion, in higher ed or not, with user details being stolen. In many of these cases, user’s passwords were not stored correctly, and in some cases, they were being stored in plaintext, which means there was no encryption or hashing being used.<\/p>\n
Before we go any further, if you are storing passwords for your web app in plaintext, shut it off immediately and fix it. Seriously.<\/p>\n
Even LinkedIn, a network built by very smart people, was only using SHA1 for their passwords, and no salt. All it takes is a rainbow table<\/a>, a powerful computer and passwords are easily cracked.<\/p>\n From Poul-Henning Kamp, writing<\/a> at the Association for Computing Machinery:<\/p>\n This is the first place LinkedIn failed utterly: Calculating the SHA1 function is very, very fast. A regular computer can crunch from 10 million to 100 million of them per second using the GPU, making it a trivial task to check even very large lists of potential passwords.<\/p><\/blockquote>\n I’ve written in the past about some ways to use salts to protect passwords<\/a>, but even some of those recommendations are now out of date.<\/p>\n Recently, for anything I’ve written that needs a login, I’ve used Bcrypt<\/a>. There are ports for just about any type of programming language out there. If you’re writing in PHP, I’d recommend PHPass<\/a>, a portable public domain password hashing framework. Takes out a bunch of work and is computationally slow, which is what you want when hashing a password.<\/p>\n If you’re looking for a refresher on password security, or you’re new to building apps and want a quick primer on how to do it right, you’ll enjoy this video from Les Hazelwood, CTO of Stormpath<\/a>. In it, he walks you through various levels of password security and how to store them, from just plain wrong to crazy and complicated. If you’ve got a few minutes, it’s really worth checking out.<\/p>\n