

“Website Passwords Hacked” headlines can be less scary - privasectech
https://privasectech.com/2013/11/website-passwords-hacked-headlines-can-less-scary/

======
dxm

      The two most common methods, md5 and sha-1 are
      both susceptible to collisions, or birthday attacks.
      As of writing this, I would recommend using
      SHA-3-256 which has no known attacks.
    

Don't do that. Hashing algorithms without salt and iteration counts is a bad
idea. Thankfully, languages and frameworks are starting to take this
responsibility away from the programmer (or at least they're making it easier)
– consider using has_secure_password in Rails, password_hash in PHP 5.5, etc.
Don't use standard hashing algorithms.

~~~
privasectech
Thanks! I have updated the article to include a paragraph on salting.

------
mschuster91
You totally forget about hash salting - this way a hacker can't use rainbow
tables or precomputed hashes for common passwords.

~~~
iLoch
I've also seen a fair bit of misunderstanding about hashes - you do not want
to apply a global salt to all your hashes. Salts should be generated on a per
hash basis, and should be stored within the hash itself. Most hashing
libraries will do this. It's usually much easier and safer to use a library
than to roll your own.

~~~
mschuster91
Indeed, yes, and I do this for all my projects. But even a global salt is way
better than no salt at all.

That aside, doesn't Wordpress still use lots of global salts?!

