Short answer: No, time() is not a good salt. Long answer: copied from my answer to Salt Generation and open source software What is a salt? A salt is a random set of bytes of a fixed length that is added to the input of a hash algorithm. Why is salting (or seeding) a hash … Read more
The way is to use ~/.netrc as outlined in step 3 of this Git documentation: Then, add the following to your $HOME/.netrc (you can do without, but will be asked to input your password a lot of times): machine <servername> login <username> password <password> …and set permissions: chmod 600 ~/.netrc UPDATE: As of git 1.7.9, … Read more
EDIT (2016): use Argon2, scrypt, bcrypt, or PBKDF2, in that order of preference. Use as large a slowdown factor as is feasible for your situation. Use a vetted existing implementation. Make sure you use a proper salt (although the libraries you’re using should be making sure of this for you). When you hash the passwords … Read more
Hint is displayed correctly with android:inputType=”textPassword” and android:gravity=”center” if you set also android:ellipsize=”start”
You can use this to prevent cookies from being stored and clean cookies already stored: CookieSyncManager.createInstance(this); CookieManager cookieManager = CookieManager.getInstance(); cookieManager.removeAllCookies(callback); cookieManager.setAcceptCookie(false); WebView webview = new WebView(this); WebSettings ws = webview.getSettings(); ws.setSaveFormData(false); ws.setSavePassword(false); // Not needed for API level 18 or greater (deprecated)
When I was in the Air Force the security rule we had was: When setting or resetting passwords, do not send the user id and the password in the same email. That way, if someone is intercepting emails snooping for passwords, he has to successfully intercept BOTH emails, and be able to connect them, to … Read more
You may provide the password already hashed with md5, as said in the doc (CREATE ROLE): ENCRYPTED UNENCRYPTED These key words control whether the password is stored encrypted in the system catalogs. (If neither is specified, the default behavior is determined by the configuration parameter password_encryption.) If the presented password string is already in MD5-encrypted … Read more
You don’t decrypt authentication passwords! Hash them using something like the SHA256 provider and when you have to challenge, hash the input from the user and see if the two hashes match. byte[] data = System.Text.Encoding.ASCII.GetBytes(inputString); data = new System.Security.Cryptography.SHA256Managed().ComputeHash(data); String hash = System.Text.Encoding.ASCII.GetString(data); Leaving passwords reversible is a really horrible model. Edit2: I thought … Read more
Warning: Since this post was written in 2010, GPUs have been widely deployed to brute-force password hashes. Moderately-priced GPUs can run ten billion MD5s per second. This means that even a completely-random 8-character alphanumeric password (62 possible characters) can be brute forced in 6 hours. SHA-1 is only slightly slower, it’d take one day. Your … Read more
How to use autoexpect to pipe a password into a command: These steps are illustrated with an Ubuntu 12.10 desktop. The exact commands for your distribution may be slightly different. This is dangerous because you risk exposing whatever password you use to anyone who can read the autoexpect script file. DO NOT expose your root … Read more