How securely do they store user passwords & how good are they at letting us know? And how do *you* store passwords? A project by Michal Špaček @spazef0rze
In your questions, asking
Joined February 2018
- Tweets169
- Following1
- Followers438
- Likes46
Pinned Tweet
Need to rehash or upgrade existing password hashes? Here's how you should do it, by @spazef0rze: michalspacek.com/upgrading-e…
"We don't have a password complexity policy. Passwords are encrypted with salt and SHA-256."
-- @Jotform
You don't encrypt passwords for authentication, you hash them. Luckily, SHA-256 is a hashing algorithm 👍 but it's not suitable for passwords 👎
pulse.michalspacek.cz/passwo…
The folks behind Slab, the knowledge base & wiki app, created a nice page where they share many security-related things including that they store passwords hashed with bcrypt: slab.com/security/#encryptio… Thumbs up for the transparency @slab & for bcrypt too!
pulse.michalspacek.cz/passwo…
"deSEC is a free DNS hosting service, designed with security in mind" (their words) and they use "PBKDF2-based password hashing to secure your sensitive information" (also their words). Nice job @desec_io! (my words this time) 😊 pulse.michalspacek.cz/passwo…
The project itself was launched in 2016 in this talk at @BSidesLV youtu.be/vt-6n2ohbOk (waving at @thorsheim 👋) and the idea itself dates back to 2014 when I gave a talk about improving security at a company I was working for back then.
The company was using unsalted SHA-1 and we migrated to bcrypt (also rehashed existing hashes, see the pinned tweet) and I thought it might be a good idea to tell the world and maybe inspire others to do the same. pulse.michalspacek.cz/passwo…
MangaDex has reached out and asked me to add their password storage disclosure announcement, very cool! Thanks @MangaDexRE & Tristan 👍 They use PBKDF2 now but some records use bcrypt and Argon2id historically.
pulse.michalspacek.cz/passwo…
OrgPad, a brainstorming tool, is using PBKDF2 with BLAKE2b to hash passwords. They disclose it publicly on their site and here on Twitter too. And they also have @securitytxt 😍 Good job @orgpad_official, thank you! pulse.michalspacek.cz/passwo…
Czech Railways, the largest Czech railway carrier have confirmed (although very unofficially) they use bcrypt for user passwords in one of their apps. Previously, they were using SHA-512 so switching to bcrypt is a very good news & very good job!
pulse.michalspacek.cz/passwo…
Unfortunately Czech Railways don't use bcrypt in all their apps. Another app doesn't use hashing at all but instead uses encryption. I really hope they'll start doing what they should and that I'll be able to update the grade soon 🤞 pulse.michalspacek.cz/passwo…
Good job @Vyfakturuj_cz @SimpleShop_cz @redbitcz and thanks for that!
Noted: pulse.michalspacek.cz/passwo…
🎉 I am happy to announce the @Vyfakturuj_cz and @SimpleShop_cz apps from @redbitcz team are now hash all user's passwords with the Bcrypt algorithm and fully support future upgrades (rehash).
➡️ @PasswordStorage
There's another bank disclosing how they store user passwords. @MONETAMoney says they use Argon2 and they have also included the info in their FAQ! They now score A, good job!
(They even @-me and thanked me 😇)
pulse.michalspacek.cz/passwo…
Previously, the bank admitted they store encrypted but promised to switch to hashing. Nice to see the promised fulfilled in some 3 months, thank you. (You may still see F in the thumbnail here until the cache is refreshed)
xitter.cf/PasswordStorage/status…
Bank admits they store passwords encrypted, not hashed, after customers started receiving passwords they created printed out via mail. Not cool @MONETAMoney but at least they say they'll move to hashing eventually. Looking forward to upgrade the score!
pulse.michalspacek.cz/passwo…
Another company publishing they use bcrypt, cool @agilebase @agileChilli! And even their CTO @okohll DMing me to add them, good job 👍 pulse.michalspacek.cz/passwo…
Czech news portal @infocz_web uses bcrypt cost 12 to hash passwords and their Head of Digital and Technology @adent has happily tweeted it himself too. Thank you 👍 pulse.michalspacek.cz/passwo…
I've added sorting and search, a feature some of you have requested quite a few times – and rightfully so, there's now 130+ sites that have somehow disclosed their password storage. Match highlighting and what not, it's all there! :-)
Basecamp uses bcrypt cost 10 to hash user passwords for both @basecamp and their email service @heyhey. And they're not afraid to tell us in their security overview PDFs, nice job! Also their CTO @dhh has no problem to tweet the info when asked, cool 👍
pulse.michalspacek.cz/passwo…
CTemplar, encrypted email service, says they use bcrypt to hash user passwords. Good job, @RealCTemplar! (Put the info in your privacy policy for example, to get A)
pulse.michalspacek.cz/passwo…
Bank admits they store passwords encrypted, not hashed, after customers started receiving passwords they created printed out via mail. Not cool @MONETAMoney but at least they say they'll move to hashing eventually. Looking forward to upgrade the score!
pulse.michalspacek.cz/passwo…
The first bank I know of that has somehow disclosed how they store passwords, is this Czech bank using Argon2. Their auth was cert-based previously and they have moved away since and luckily didn't choose MD5 as their fav algorithm :-) Good job @komercka! pulse.michalspacek.cz/passwo…
