Welcome • User Guide
ToS • Privacy • Canary
Donate • Bugs • License

©2025 Poal.co

1.3K

It's really not hard. You just use a library to make use of either pbkdf2 or scrypt to generate a hash the correct way for a password.

In either case it basically just means doing this. Take your password, add a salt to it (just a bunch of random extra text), and send it through a hash like sha1/sha256/sha512. Now take the result of that, add the salt to it again, hash it again. Repeat 100,000 times. That's the hash you store. This is basically a standard at this point so there really is no excuse. And there are libraries built into pretty much every language to do that basically as easily as generating any kind of hash. Also do a unique salt per user.

Extra step I take is to randomize the number of iterations a little bit for each password stored so if someone does try to break a password they have to compare every hash for every word they guess instead of finding that the code says 100,000 exactly and only looking at the hash at that iteration. It's just a little extra hassle. Now that password is still breakable if it's a dictionary word or super common, but two things are for certain, they aren't going to be able to crack good passwords, and they won't be able to afford to crack the entire database of passwords. The second part is what pisses me off about these password leaks. It's clear that some of the passwords I've used that are now in leaked databases were clearly bulk cracks. Anyone who targets your account specifically isn't then going to share it on an exchange.

If you are going to store passwords get it right. There is so much more about web development that is 100x harder. Just take 15 minutes to read your language's documentation on how to access that utility they've probably provided. 15 minutes is if you are a slow reader. It's more like 5. You are storing people's passwords. A 5 minute investment is not too much to ask for. If your language doesn't have that in a way that's easily accessible then you aren't in a web-dev language. If you are still building sites in perl you should fix that first.

Congratulations! Just by reading this you are now more qualified to be hired as a web-dev than the morons target and home depot hired who lost everyone's CC information. Go apply to a job.

It's really not hard. You just use a library to make use of either pbkdf2 or scrypt to generate a hash the correct way for a password. In either case it basically just means doing this. Take your password, add a salt to it (just a bunch of random extra text), and send it through a hash like sha1/sha256/sha512. Now take the result of that, add the salt to it again, hash it again. Repeat 100,000 times. That's the hash you store. This is basically a standard at this point so there really is no excuse. And there are libraries built into pretty much every language to do that basically as easily as generating any kind of hash. Also do a unique salt per user. Extra step I take is to randomize the number of iterations a little bit for each password stored so if someone does try to break a password they have to compare every hash for every word they guess instead of finding that the code says 100,000 exactly and only looking at the hash at that iteration. It's just a little extra hassle. Now that password is still breakable if it's a dictionary word or super common, but two things are for certain, they aren't going to be able to crack good passwords, and they won't be able to afford to crack the entire database of passwords. The second part is what pisses me off about these password leaks. It's clear that some of the passwords I've used that are now in leaked databases were clearly bulk cracks. Anyone who targets your account specifically isn't then going to share it on an exchange. If you are going to store passwords get it right. There is so much more about web development that is 100x harder. Just take 15 minutes to read your language's documentation on how to access that utility they've probably provided. 15 minutes is if you are a slow reader. It's more like 5. You are storing people's passwords. A 5 minute investment is not too much to ask for. If your language doesn't have that in a way that's easily accessible then you aren't in a web-dev language. If you are still building sites in perl you should fix that first. Congratulations! Just by reading this you are now more qualified to be hired as a web-dev than the morons target and home depot hired who lost everyone's CC information. Go apply to a job.

(post is archived)

You are currently inside a comment thread.
Click here to see all the comments (26).
[–] • 1 pt

So, writing all my passwords down on a yellow legal pad and storing in my desk drawer, instead of clicking yes whenever I’m asked if I want to “store” my password, is good or bad? Apologies in advance for being a technophobe or technoidiot.

[–] • 2 pts

writing all my passwords down on a yellow legal pad and storing in my desk drawer

If nobody can ever access that desk drawer then it’s pretty safe lol.

[–] • 0 pt

Only 1 person besides me and spouse that can access it, atm. If that ever changes, I likely won’t have any electronic devices. Glad to know I’m good lol.

[–] • 1 pt (edited )

That's good. It's pretty easy to access the passwords stored in a computer. Even if you are worried about people with physical access, looking up the entirety of stored passwords inside chrome, brave, firefox is just a few clicks in settings and they can snap a photo with a phone.

The downside of using paper is you are more likely to reuse passwords multiple times (only so much you can fit on paper), and eventually one of these sites will leak it. If you are going to be reusing passwords anyway I would suggest making them strong while you are at it.

Me, I have a few really weak passwords I don't care about, and the rest I generate and re-generate in a program I wrote based on the name of the website and a key encrypted on my computer. That gets me super random passwords about 120 characters long (that I shorten to 20 when sites complain) that aren't actually stored anywhere. I just need to know one master password for the decrypt of that file that I never put on the internet. I then have that key on multiple computers (also the program) so I never lose it.

[–] • 0 pt

The word you're looking for is techdumb, some people are techdumb, and some techdumbs have super powers; I had a friend (yes) who would make anything computer go sideways just by laying his hands on a laptop's keyboard for instance, not even typing anything, just resting, and everytime you just had to wait for a couple of seconds or minutes before something started to break and bug. True story.

[–] • 1 pt

I feel like you’re speaking of me haha. I have BAD electronic mojo. Everything electronic I touch turns to shit. Been that way a long time, long before home desktops, laptops, and phones. Techdumb fits better than technophobe. Not afraid of it, but perhaps “it” is afraid of me lol.

[–] • 1 pt (edited )

It's a gift, god's gift...

Some have the power of clairvoyance, some have the power of telepathy, some have the power of psychokinesis... You got the power of techdumb. You can dumbdown any electronic device just by being there