[eluser]dmorin[/eluser]
Quote:Also remember that NOTHING in cryptography is unbreakable - it’s just a matter of time and effort.
I believe the same thing about websites. Assuming your application can never be broken and therefore, protecting your database is pointless, is just not smart.
Quote:If you have a weakness in your infrastructure that would allow access to your password store, you have way bigger issues than how you encrypt your passwords.
If you thought your infrastructure was impenetrable, you wouldn't need to hash your passwords at all... (you'd also be wrong, but hey...)
So while I agree to a point, upon further reflection, it's also fairly short-sighted.
EDIT:
Sorry one more point:
Quote:Secondarily, I tend to use a combination of MD5 and SHA1 in various methods of split/concat/encrypt/encode so that the final product is a one-way hash of several other hashes so it’s ridiculously unlikely to be broken even if it is hacked into.
If someone was able to get your code along with your data store and you use the same "algorithm" of combining different hashes for each password, it would be trivial to make rainbow tables for your custom algorithm. The only advantage you get is that the multiple steps would make it take computationally longer to create, so I guess that's something.
