Websites which knows your new password is similar to your old one

vorticalbox · December 4, 2018

9 minutes ago, reniat said:

talk to a security team if you have one to make sure they are on board

That the position I'm moving into but I can always run it past my CTO

9 minutes ago, reniat said:

profile and benchmark your current login to make sure you don't add too much time between input and response (it really shouldn't be an issue, but always measure before/after)

This is something I'll be doing as I'll be leading the lead in creating our apis in aws lambda and I do think things fast.

9 minutes ago, reniat said:

I would definitely avoid extracting the salt from the hash, and just store it in another column at the time when the new password is chosen like you would if you weren't using bcrypt.

This is my main considered just now but I need to work on my back log before I get the play with new things

we are also moving to aws cognito for handling our auth, means we can break all our front ends into s3 and back ends will be all lambdas.

reniat · December 4, 2018

12 minutes ago, KuJoe said:

I personally hate it when I see a DB dump with a field named 'salt', but that might just be me.

Again, as long as the salt isn't leaked ahead of a breach, the attacker doesn't gain much for having the salt + password hash. The only way the attacker benefits from knowing a salt is if they get it, but not the password hash, and have time to build a rainbow table so that if they DO get the hash they might have it pre-computed. If there is a breach and they get hashed passwords, learning the salt at the exact same time really won't make much difference except for the added length, and that's it. Plus if there's a breach, it's likely that if they can get your password hashes they can probably get your salts anyway.

EDIT: it's like hiding your car radio in your glove box every time you park. Sure it's technically an extra security step, but if they are already in your car they can probably get into the glovebox and you're just adding extra work for yourself.