From 9909e7beca940f09166bf22d9a6844304a3943b9 Mon Sep 17 00:00:00 2001 From: "xuanyi.wang" Date: Thu, 25 May 2023 17:33:26 +0200 Subject: [PATCH] Update page 'OWASP test - Sloetjes' --- OWASP test - Sloetjes.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/OWASP test - Sloetjes.md b/OWASP test - Sloetjes.md index 67070ff..9614ca4 100644 --- a/OWASP test - Sloetjes.md +++ b/OWASP test - Sloetjes.md @@ -75,8 +75,6 @@ > Peppers should be stored separately from the database, like in the application code or a separate configuration file. They should be securely managed and access should be limited only to trusted individuals. It's important that peppers are included in backups, but they should be stored separately from the data they protect to maintain their effectiveness. * Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database. - - > * bcrypt: You can use a cost factor of 10-12, which determines the computational cost of the hash. > * scrypt: Parameters include CPU/memory cost factor, block size, and parallelization factor. Recommended values might be N=16384, r=8, p=1. > * Argon2: Recommended parameters vary depending on the specific use-case and threat model. The OWASP password storage cheat sheet doesn't provide specific recommendations but does mention Argon2 as a good choice.