How should an application store user passwords?

Question

Accepted Answer

A strong, iterative, salted hash such as bcrypt or PBKDF2 — with a per-user random salt — A slow, per-user-salted KDF makes cracking and rainbow tables infeasible (CWE-916) — a single fast SHA-256 is mass-crackable on GPUs, reversible encryption means a key leak exposes every password, and one shared salt lets identical passwords be attacked together.

Answer

A single pass of a fast hash like SHA-256 — applied directly to the raw user password

Answer

Symmetric encryption with a server-side key — so the passwords can be decrypted if needed

Answer

A hash using one shared application-wide salt — appended to every user's password value

How should an application store user passwords?

Why this is the answer

More Secure Coding flashcards