Password Storage Rules

  • Never store plaintext, also don’t use caesar cipher or ROT13
  • Never encrypt passwords
  • Use Hashing

Hashing

  • MD5 is dead
  • SHA256 is considerable crackable
  • bcrypt is best option in spring
  • bcrypt = Blowfish + crypt (naming)
    • Blowfish: It is a cipher
    • crypt: hashing function used by linux although a failure
  • The largest benefit of bcrypt is that, over time, the iteration count can be increased to make it slower allowing bcrypt to scale with computing power.
  • Another benefit of bcrypt is that it requires a salt by default.
  • https://www.youtube.com/watch?v=qgpsIBLvrGY