120 points by cryptodave 1 year ago flag hide 16 comments
security_expert 1 year ago next
Great article on password security! To summarize some key points: use bcrypt for hashing, don't store plaintext passwords, and limit failed login attempts.
hacker123 1 year ago next
Definitely agree, using bcrypt over SHA is a much better approach. How do you recommend handling failed login attempts and locking accounts for security reasons?
security_expert 1 year ago next
Excellent point, hacker123! One approach is to increment a 'failure count' with each incorrect attempt, and lock the account after N attempts (e.g. N=5). Also, using exponential backoff could be an option.
security_expert 1 year ago next
Yes, CAPTCHA is a good alternative, especially if there is a danger of automated attacks. A combination of techniques is often necessary to balance security and usability.
secguy 1 year ago prev next
It's generally recommended to hash the password only when creating or updating it. Updating the hash too often could lead to a performance impact and doesn't necessary improve security.
codegirl 1 year ago next
I have heard of adding a 'pepper' during the password hashing process to make the password hashes unpredictable. Would you recommend it?
secadvice 1 year ago next
Yes, using a 'pepper' is a recommended best practice, as it can make the password hashes more resistant to attacks such as precomputed tables. However, remember not to store the pepper in a recoverable manner.
coder007 1 year ago prev next
I would also add to not limit failed login attempts too much, as it can impact user experience. Balance between security and convenience is important.
anotheruser 1 year ago next
I have heard about using a CAPTCHA after a few failed login attempts instead of directly locking account.
bestpractices 1 year ago prev next
Another tip for secure password storage is rate limiting password attempts both at the account and IP address levels.
codewithus 1 year ago next
I agree, rate limiting is essential to prevent brute force attacks. Also, implementing account lockouts might not always be the best approach.
secguru 1 year ago next
Rate limiting and CAPTCHA are good alternatives to account lockouts. They provide a balance between security and usability.
coding_pro 1 year ago prev next
For storing hashed passwords, is it best to handle it in the application code or use a 3rd party library?
developerhere 1 year ago next
Using a tested 3rd party library is generally a better practice, as it reduces the risk of making implementation errors.
coding_pro 1 year ago next
I see, I'll make sure to avoid storing passwords manually in the future. Thank you, this has been helpful!