Efficiently Storing Passwords in .NET Framework

Sign in to leave a comment.

• 

  Kuppurasu Nagaraj10y agoPosted Apr 11, 2016, 1:50 PM

  Nice Sharing
• 

  Sonu Chaudhary10y agoPosted Mar 7, 2016, 11:54 AM

  nice
• 

  Sabyasachi Mishra10y agoPosted Nov 5, 2015, 6:33 AM

  Good one
• 

  Humayun Kabir Mamun11y agoPosted Aug 29, 2015, 5:56 AM

  Great...
• 

  Abhishek Jaiswal11y agoPosted Aug 1, 2015, 11:02 AM

  Yeah, it was quite healthy discussion, and will look forward to see some more interesting soon. :)
• 

  Afzaal Ahmad Zeeshan11y agoPosted Jul 31, 2015, 2:58 PM

  Thank you for your time and replies, Abhishek Jaiswal :). I would definitely try to add a few more details on cryptography and hashing. Stay tuned! Right now, I am going to look deeper in this consumer version of Windows 10 and provide a few more articles for this.
• 

  Abhishek Jaiswal11y agoPosted Jul 31, 2015, 8:44 AM

  Okay cool, sounds good in that case. Will wait to go through the upcoming parts of this article series. Keep sharing more! :)
• 

  Afzaal Ahmad Zeeshan11y agoPosted Jul 31, 2015, 6:48 AM

  Good points, Abhishek Jaiswal :). But let me clarify a few more things for you. A salt is a "Random string of alphanumeric characters". Note the term, "Random". Random means that the attacker won't be able to capture it, that is why for every user and their every password a new salt (Random string of alphanumeric characters) must be generated. Now, how would the attacker hold the salt? ;-) He would have no idea of the salt. Secondly, I did read that a slow algorithm must be used, for what? "Just to waste the time of hacker". For that purposes, you can even use Thread.Sleep(500); wait for half a second, as to impact on a hacker too much and to not annoy the user. There is no other purpose to make the algorithm slow. I would still recommend using SHA-256 for small companies and personal applications.
• 

  Nilesh Jadav11y agoPosted Jul 31, 2015, 6:28 AM

  Nice one sir
• 

  Abhishek Jaiswal11y agoPosted Jul 31, 2015, 5:49 AM

  Ooh okay but in case of a salted password, such an attack is still possible. What, if the attacker has the salt? He will simply input the salt in your algorithm. As per the general view and my understanding- What a salt protect against, is a ‘Rainbow Table’ right? and producing a rainbow table is itself a costly step (depending on the size of the dictionary used as input), but then you can use it without any cost later to lookup as many passwords as wanted. As salt protects against this, since you now would need a separate table for each salt. Even with the simple Unix-Crypt's 2-letter salt, (already is a factor of 3,844.} Modern password hash algorithms use a much larger salt. So I think to protect against dictionary attacks, one must use a slow hash algorithm instead of a fast one like simple MD5 or SHA1/SHA2. ‘Bcrypt’ is such an algorithm with a configurable work factor, and other is ‘Scrypt’, which not only takes much time, but also needs lots of memory, which attackers often don't have as much as processing power. So it maybe better option than that. Cheers!! :)
• 

  Afzaal Ahmad Zeeshan11y agoPosted Jul 31, 2015, 4:33 AM

  Thank you for your question, Abhishek Jaiswal :). I did mention that SHA-x based algorithms must be used, because MD5 is no longer secure as it generates only 16-byte string which can be easily cracked using a rainbow table. For this, you must use SHA-x based. SHA-256 would be a perfect fit, because of its compact size but resilient design against password cracks. SHA-512 is even better, but you can see that it generates a very long string. If database storage in your application is not a problem, then you must always go with SHA-512. Otherwise, SHA-256 would be a good to go. But, "remember", always remember to add Salt to your password before hashing, it would make sure that the password is secure from any dictionary attacks. Dictionary attacks won't work, if there is no word in the dictionary. Adding a random salt, and using different words, such as "xh23jcfwjHelloWorld" is not able to be recognized by dictionary attacks. :) I would say again, "Stay safe!". :-)
• 

  Abhishek Jaiswal11y agoPosted Jul 31, 2015, 2:26 AM

  Just eager to know which Hashing technique you are going to use in it, btw nice read. Thanks for sharing! :)
• 

  Rajeesh Menoth11y agoPosted Jul 31, 2015, 2:19 AM

  Good One sir..
• 

  Sibeesh Venu11y agoPosted Jul 31, 2015, 1:58 AM

  Nice Share!.\
• 

  Gopi Chand11y agoPosted Jul 31, 2015, 12:39 AM

  Excellent work
• 

  Mohammed Ibrahim11y agoPosted Jul 30, 2015, 5:37 PM

  nice
• 

  Neeraj Kumar11y agoPosted Jul 30, 2015, 3:08 PM

  Great Article.Thank you for sharing...