Contents
Should you hash username?
No, you should not. Otherwise, you could not show a list of registered users, or anything of that type. It would also make a lot of other functions unnecessarily clunky. Just use a one way digest method (such as bcrypt) on the user’s password with a suitably high work factor.
Can I use username as salt?
By using usernames as salts, we provide attackers with enough information ahead of time to weaken the system’s security. With random salts, work to crack the password hashes can only begin after the target system has been compromised.
Can you identify someone by the hash of a username?
It depends on whether you can identify the person to whom a username hash belongs. If you store both username and its hash in the same database row then yes. If it is impracticable for you to identify the person by their hash only, then no.
Why do I need to change my password hashing mechanism?
And changing your password hashing mechanism is a real pain because it means all the users have to change their passwords. The point of the salt is to be unique. The salt is meant to prevent attack cost sharing, i.e. an attacker trying to attack two hashed passwords for less than the twice the cost of attacking one.
How is the hash of a password calculated?
A hash of the password is calculating as the password is entered, and is then forwarded to the server for password authentication. The passwords saved on the server are simply the original passwords’ calculated hash values. This is required to guarantee that no sniffing is present when the password is transmitted from client to server.
Can you find Jason’s password based on the hash?
Can you find what is jason ‘s password based on the hash 695 ddccd984217fe8d79858dc485b67d66489145afa78e8b27c1451b27cc7a2b? Attacker gets DB. Sees duplicate hashes. Attacker can arrive to conclusion that there’s no salts or using a weak algo to hash the passwords.