I am back working on a game I started a while back, and want to put into action many things I have learnt since then. I am doing the register user page at the moment, and wanted to discuss the best security measures for a password.
I was thinking what characters should be left out of a password, and after doing a bit of a google search, saw many people would allow every character. The problem being, I don't know what effect foreign keyboards would have on passwords (languages with accents on letters etc).
For the encryption part, I have read SHA-512 is a good hash to use, so I am leaning towards that but may try a couple of others to see how they work.
I would like to develop a really good password encryption script which can be used in many future projects, so I thought I'd ask the many people here their opinions on password security/encryption and how they handle it.
Security
-
vitinho444
- Posts: 2819
- Joined: Mon Mar 21, 2011 4:54 pm
Re: Security
I putted my game on test on the support forum so the community can try to hack it.
For now i allow A-Z 1-9 characters only. But i think if you make a good encryption system it would be good for your games. Maybe you create SUPER MD5 xD
Good luck.
For now i allow A-Z 1-9 characters only. But i think if you make a good encryption system it would be good for your games. Maybe you create SUPER MD5 xD
Good luck.
Re: Security
Character sets don`t matter. As long as you hash it, the characters will be translated to a 128bit address, regardless of anything. I wouldn`t worry about special characters either, chances are that they`ll use the same types of keyboards in the region they are creating the character.
Sha 512 is a good viable option, however, don`t ever forgot to add a salt and pepper solution! Rainbow tables and dictionary attacks contain many possible combinations. By adding an extra salt and pepper ( preferably random ) you`ll force them to bruteforce, which would take years depending on the combination.
Another possibility is checking for the possible entropy or better yet, forcing a user to get a certain entropy. Any entropy bigger then 30 takes a while just using dictionary and rainbowing it.
Sha 512 is a good viable option, however, don`t ever forgot to add a salt and pepper solution! Rainbow tables and dictionary attacks contain many possible combinations. By adding an extra salt and pepper ( preferably random ) you`ll force them to bruteforce, which would take years depending on the combination.
Another possibility is checking for the possible entropy or better yet, forcing a user to get a certain entropy. Any entropy bigger then 30 takes a while just using dictionary and rainbowing it.
-
Foofighter
- Posts: 121
- Joined: Sun Mar 04, 2012 1:52 pm
Re: Security
exatly putting a salt to the saved password is the best and easiest way, this means u generate a random term and add it to your pw. I'am sure you find a thread on this topic.Xaleph wrote:Character sets don`t matter. As long as you hash it, the characters will be translated to a 128bit address, regardless of anything. I wouldn`t worry about special characters either, chances are that they`ll use the same types of keyboards in the region they are creating the character.
Sha 512 is a good viable option, however, don`t ever forgot to add a salt and pepper solution! Rainbow tables and dictionary attacks contain many possible combinations. By adding an extra salt and pepper ( preferably random ) you`ll force them to bruteforce, which would take years depending on the combination.
Another possibility is checking for the possible entropy or better yet, forcing a user to get a certain entropy. Any entropy bigger then 30 takes a while just using dictionary and rainbowing it.
regards
-
alexrules01
- Posts: 175
- Joined: Sun Oct 11, 2009 9:33 am
Re: Security
Yea I have been looking at salts aswell, will deffinately add them.
Just one question, I have seen this a couple of times. I'll use the SHA-512 as an example:
If it starts with rounds=<N>$, what does this actually do? I have read in the PHP manual how many times it loops through the hash, but I don't see what the difference would be making N=5000 or N=10,000. Does anyone know why?
Just one question, I have seen this a couple of times. I'll use the SHA-512 as an example:
If it starts with rounds=<N>$, what does this actually do? I have read in the PHP manual how many times it loops through the hash, but I don't see what the difference would be making N=5000 or N=10,000. Does anyone know why?