Basically, your friend is right. But simply hashing the password on the client side is only just better than submitting it as plain text to the server. Someone, who can listen for your plain text passwords is certainly also able to listen for hashed passwords, and use these captured hashes him/herself to authenticate against your … Read more
Update: revised in May 2013 for a better approach The user enters his username and hits “forgot password”. I also recommend the option of entering the email address instead of the username, because usernames are sometimes forgotten too. The system has a table password_change_requests with the columns ID, Time and UserID. When the new user … Read more
The easiest way to get your password storage scheme secure is by using a standard library. Because security tends to be a lot more complicated and with more invisible screw up possibilities than most programmers could tackle alone, using a standard library is almost always easiest and most secure (if not the only) available option. … Read more
Ok. Seeing as I need to write about this over and over, I’ll do one last canonical answer on pepper alone. The Apparent Upside Of Peppers It seems quite obvious that peppers should make hash functions more secure. I mean, if the attacker only gets your database, then your users passwords should be secure, right? … Read more
Personally, I would use mcrypt like others posted. But there is much more to note… How do I encrypt and decrypt a password in PHP? See below for a strong class that takes care of everything for you: What is the safest algorithm to encrypt the passwords with? safest? any of them. The safest method … Read more
Python has no built-in encryption schemes, no. You also should take encrypted data storage serious; trivial encryption schemes that one developer understands to be insecure and a toy scheme may well be mistaken for a secure scheme by a less experienced developer. If you encrypt, encrypt properly. You don’t need to do much work to … Read more
You can do these checks using positive look ahead assertions: ^(?=.*[A-Z].*[A-Z])(?=.*[!@#$&*])(?=.*[0-9].*[0-9])(?=.*[a-z].*[a-z].*[a-z]).{8}$ Rubular link Explanation: ^ Start anchor (?=.*[A-Z].*[A-Z]) Ensure string has two uppercase letters. (?=.*[!@#$&*]) Ensure string has one special case letter. (?=.*[0-9].*[0-9]) Ensure string has two digits. (?=.*[a-z].*[a-z].*[a-z]) Ensure string has three lowercase letters. .{8} Ensure string is of length 8. $ End anchor.
In MySQL 5.7, the password field in mysql.user table field was removed, now the field name is ‘authentication_string’. First choose the database: mysql>use mysql; And then show the tables: mysql>show tables; You will find the user table, now let’s see its fields: mysql> describe user; +————————+———————————–+——+—–+———————–+——-+ | Field | Type | Null | Key | … Read more
>>> import getpass >>> pw = getpass.getpass()
Passwords are hashed to 32, 40, 128, whatever length. The only reason for a minimum length is to prevent easy to guess passwords. There is no purpose for a maximum length. The obligatory XKCD explaining why you’re doing your user a disservice if you impose a max length: