2

Given a site that uses the default ASP.NET Membership Provider and the membership password format is configured to use hashing and the hash algorithm is SHA1 (the default; same one used by LinkedIn) and assuming the membership database is breached, are there any additional steps that can be taken to further mitigate exploitation of said data?

From quickly looking at the membership schema, passwords seem to utilize a salt key. Is this measure sufficient?

Rudy
  • 920
  • 9
  • 19
  • I like the answer and this is only a comment. I assume you are using MSSQL. A general review of your SQL security and security on the web site. I know obvious but close port 1433 .... – paparazzo Jun 07 '12 at 22:42
  • P.S. I would remove LinkIn Password Leak from the title as that implies a "LinkIn Password Leak" – paparazzo Jun 07 '12 at 22:44

1 Answers1

3

To make things short: for storing passwords, you should never go with MD5, SHA1, SHA256, SHA512, SHA-3, etc... bcrypt is the only safe way to store a password.

Here is the why of the affirmation above:

Since my question a while back

Is this the way to salt and store a Password in Db?

I started to use BCrypt as my password hashing code, and from what I keep reading, even if you get hold of the users table, it is pretty difficult from that get the plain text of the storage password.

I use this in my Custom Membership Provider so I get to host my own passwords.

From the blog post:

Why BCrypt? Most popular password storage schemes are based on fast hashing algorithms such as MD5 and SHA-1. BCrypt is a computationally expensive adaptive hashing scheme which utilizes the Blowfish block cipher. It is ideally suited for password storage, as its slow initialization time severely limits the effectiveness of brute force password cracking attempts. How much overhead it adds is configurable (that's the adaptive part), so the computational resources required to test a password candidate can grow along with advancements in hardware capabilities.

From codahale.com you can also read How to safely store a password as well...

By the way, BCrypt project is on Codeplex

Community
  • 1
  • 1
balexandre
  • 73,608
  • 45
  • 233
  • 342
  • So the gist is to use a hashing algorithm that is not built for speed, which bcrypt fulfills but requires a custom membership provider? – Rudy Jun 08 '12 at 01:03
  • you can only `override` the create user and get user methods so you can use bcrypt, as the default Membership only uses normal hashing. If you read my answer, you will see that is quite easy to do. – balexandre Jun 08 '12 at 06:56