3
votes
4answers
89 views

Can I save & store a user's submission in a way that proves that the data has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
0
votes
2answers
41 views

Hashing + security as it pertains to a theoretical file sharing site

These days it's possible to hash a file client-side, send the hash to the server, and have the server check whether or not that file is already uploaded. If it is, we can skip the file upload and make ...
3
votes
2answers
271 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
14
votes
6answers
924 views

How to assure users that website and passwords are secure

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
2
votes
4answers
273 views

Preventing password hashing algorithm from overloading CPU

These days password hashing algorithms are designed to be slow. While it prevents black hats from guessing the password (at least partially), it also gives additional work for the server. I can ...
14
votes
7answers
1k views

What makes a hashing algorithm “secure”?

After reading this interesting question, I felt like I had a good idea of which insecure hashing algorithm I'd use if I needed one, but no idea why I might use a secure algorithm instead. So what is ...
4
votes
5answers
471 views

Is it possible to insert the hash of an executable into the executable itself without changing the resulting hash? What's the best alternative?

I've been thinking about this problem recently and it really doesn't seem like it's possible, but I figured that I'd ask just in case. Assume a simple program, in pseudocode: run hash on an ...
19
votes
8answers
14k views

Why almost no webpages hash passwords in the client before submitting (and hashing them again on the server), as to “protect” against password reuse?

Relevant XKCD There are many sites on the Internet that require login information, and the only way to protect against password reusing is the "promise" that the passwords are hashed on the server, ...
7
votes
6answers
3k views

Where should salt hash values come from?

When adding salt values to a hash value for something like a password that cannot be stored in plain text, what is the best place to get the salt values come from? For context, let us suppose this is ...