SVIG/python-bootcamp
7
0
Fork 1
Code Issues Pull Requests 1 Releases Wiki Activity

Update page 'OWASP test - Sloetjes'

xuanyi.wang
2023-05-25 17:21:41 +02:00
parent 2b36cc120e
commit 96051b15ba
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OWASP test - Sloetjes.md
-1
@@ -68,7 +68,6 @@
> Peppers should be stored separately from the database, like in the application code or a separate configuration file. They should be securely managed and access should be limited only to trusted individuals. It's important that peppers are included in backups, but they should be stored separately from the data they protect to maintain their effectiveness. > Peppers should be stored separately from the database, like in the application code or a separate configuration file. They should be securely managed and access should be limited only to trusted individuals. It's important that peppers are included in backups, but they should be stored separately from the data they protect to maintain their effectiveness.
* Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database. * Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database.
> As of my knowledge cutoff in September 2021, bcrypt, scrypt, and Argon2 are considered secure password hash functions.
> bcrypt: You can use a cost factor of 10-12, which determines the computational cost of the hash. > bcrypt: You can use a cost factor of 10-12, which determines the computational cost of the hash.
> scrypt: Parameters include CPU/memory cost factor, block size, and parallelization factor. Recommended values might be N=16384, r=8, p=1. > scrypt: Parameters include CPU/memory cost factor, block size, and parallelization factor. Recommended values might be N=16384, r=8, p=1.
> Argon2: Recommended parameters vary depending on the specific use-case and threat model. The OWASP password storage cheat sheet doesn't provide specific recommendations but does mention Argon2 as a good choice. > Argon2: Recommended parameters vary depending on the specific use-case and threat model. The OWASP password storage cheat sheet doesn't provide specific recommendations but does mention Argon2 as a good choice.