Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

22
  • 16
    Could you explain why this is 'BAD BAD BAD'? I thought repeated hashing or processing the hash inputs can help thwart rainbow table or brute force attacks. How does this introduce vulnerabilities? Commented Dec 18, 2012 at 15:35
  • 78
    @jdm The "BAD BAD BAD" part refers to the pointless shuffling of the MD5 hash, since it offers zero extra security, but in this case the "repeated" hashing is badly designed. It relies on MD5, crypt (whatever that ends up being configured to) and SHA1 all at once, but only really does 3 computations. That's nowhere near enough to defeat GPU-based bruteforce. The whole thing brings nothing but obscurity, and is probably less secure than sha1(md5(pass+salt)) with a decent salt. It's important to use a proper key derivation algorithm (see the first link). Commented Dec 18, 2012 at 15:38
  • 31
    Thank you. I am equally frustrated, believe me. Dave is a great guy, and has done excellent work in the past. His reaction to all of this took me by surprise. He's missing some fundamental concepts that could be picked up with a simple Google search. I'm not trying to be vindictive or cruel, but I'm done trying to explain this to him. This is exactly the kind of feedback he needs ... Commented Dec 18, 2012 at 15:44
  • 54
    @nallenscott To be fair, I went through the same phase when I was learning to code - I wanted to do everything myself, and quickly fell into the trap of writing my own "encryption" and hashing. Then I actually learnt about real security, and discovered much of what I'd previously written was horribly broken. Massive wakeup call! Commented Dec 18, 2012 at 15:48
  • 76
    @Casey: offcourse, always invent your own. Make your own linked list, your own crypto, your own database, your own mergesort. Implement the algorithms and datastructures to understand them better. Then throw the implementation away - the existing are almost always better. If not, get on the project and improve them! Your peers will review your changes and give feedback. If you're wrong, you'll learn, if you're right, your changes benefit all humankind ;) Commented Jan 24, 2014 at 9:07