Security questions, answered
98 short answers from 20 guides. Each set links to the full guide for the worked examples and the reasoning behind the answer.
.htpasswd Explained: Basic Auth, bcrypt and APR1 on Apache and nginx
How do I create an .htpasswd file?
An .htpasswd file holds one line per user, username:hash, where the prefix of the hash names the algorithm. Apache's htpasswd tool creates lines, with -B for bcrypt. nginx has no tool of its own, so people install apache2-utils or httpd-tools, use openssl passwd -apr1, or generate lines elsewhere. Keep the file outside the document root.
How does HTTP Basic authentication work?
HTTP Basic authentication, defined in RFC 7617, answers a request for a protected URL with 401 Unauthorized and a WWW-Authenticate: Basic realm header. The browser asks for a login and repeats the request with Authorization: Basic plus the base64 encoding of user:password. Base64 is not encryption, so Basic auth is only acceptable over HTTPS, and credentials are sent with every request.
How do I set up basic auth in nginx?
Add auth_basic "Restricted area"; and auth_basic_user_file /etc/nginx/.htpasswd; inside the location block to protect. nginx verifies APR1, {PLAIN}, {SHA} and {SSHA} itself and passes other hashes, including bcrypt, to the operating system's crypt() function, so bcrypt support depends on the C library. APR1 is the portable fallback.
What bcrypt cost should I use in an .htpasswd file?
Apache's htpasswd defaults to bcrypt cost 5, and 10 to 12 is a reasonable range for a small protected area. Each step up doubles the work. Because Basic authentication re-checks the password on every request, a high cost multiplies across every page, image and API call behind the login, so time it on the server before choosing.
What is the difference between $apr1$ and $1$ hashes?
$apr1$ and $1$ hashes use the same algorithm, md5crypt, which Poul-Henning Kamp wrote for FreeBSD in 1994: 1,000 MD5 rounds with a salt of up to 8 characters. The Apache Portable Runtime adopted it with a different marker so it behaved identically on every platform. Apart from the prefix they are byte-for-byte identical, and both are too fast for modern use.
AES-GCM vs AES-CBC: Encrypting Text with a Password Properly
What is a padding oracle attack?
A padding oracle attack targets AES-CBC when a server reveals whether decrypted padding was valid, through an error message or even response timing. An attacker can then decrypt the whole message one byte at a time. Vaudenay described it in 2002, and it broke ASP.NET, Java Server Faces and parts of TLS. Encrypt-then-MAC with HMAC-SHA256 prevents it.
What happens if you reuse an IV with AES-GCM?
Reusing an IV with the same key in AES-GCM makes the keystream repeat, so the XOR of two ciphertexts equals the XOR of their plaintexts. It also leaks the authentication key, allowing forgeries. Random 12-byte IVs are safe up to about 2^32 messages per key, the limit in NIST SP 800-38D; beyond that, use a counter IV or rotate the key.
Why should you never use AES in ECB mode?
ECB mode encrypts each 16-byte block separately, so identical plaintext blocks give identical ciphertext blocks and patterns survive encryption. The classic demonstration is a bitmap of the Linux penguin that is still recognisable after ECB encryption. No modern design should use ECB, and the Web Crypto API does not even offer it.
How does openssl enc derive the key with -pbkdf2?
With -pbkdf2, openssl enc writes the 8 bytes Salted__ and an 8-byte random salt before the ciphertext, which is why the Base64 output starts with U2FsdGVkX1. PBKDF2-HMAC-SHA256 with 10,000 iterations by default derives 48 bytes: the first 32 are the AES-256 key and the last 16 are the CBC IV, which is not stored.
What is authenticated encryption?
Authenticated encryption both hides data and detects any change to it. AES-GCM computes a 16-byte tag with a polynomial hash called GHASH over the ciphertext; on decryption the tag is recomputed, and if the key is wrong or a single bit of ciphertext, IV or tag has changed, decryption fails and returns nothing. TLS 1.3 uses AES-GCM or ChaCha20-Poly1305.
Bcrypt Explained: Salts, Cost Factors and Storing Passwords Safely
How do I read a bcrypt hash?
A bcrypt hash is a 60-character string such as $2b$12$ followed by 53 characters. $2b$ is the algorithm version, 12 is the cost factor meaning 2^12 iterations, the next 22 characters are a 128-bit random salt in bcrypt's own Base64 alphabet, and the last 31 characters are the hash itself.
What is the bcrypt 72-byte password limit?
Bcrypt only uses the first 72 bytes of a password. Multi-byte UTF-8 characters count as several bytes, and some libraries silently truncate while others throw an error. If you pre-hash long inputs with SHA-256, Base64-encode the digest first, since raw digest bytes can contain zero bytes that some implementations treat as the end of the string.
Why is SHA-256 bad for storing passwords?
SHA-256 is designed to be fast, and speed is exactly what an attacker wants when guessing offline against a stolen database: modern GPUs compute billions of SHA-256 hashes per second. Password storage needs a unique salt per password and deliberate slowness, which bcrypt, scrypt and Argon2 provide.
How do I increase the bcrypt cost factor without a migration?
Because the cost is stored in each bcrypt hash, you can raise it over time without a migration. On each successful login, check the cost in the stored hash; if it is below your current target, re-hash the password, which you have in plain text at that moment, and save the new hash.
What is a pepper in password hashing?
A pepper is a secret stored outside the database and combined with the password before hashing, so a database-only leak is not enough to start cracking. It complements bcrypt's per-password salt. Bear in mind that adding a pepper counts toward bcrypt's 72-byte input limit.
Blur, Pixelate or Black Box? Hiding Private Details in Images
Should I blur or pixelate text in a screenshot?
Neither, for sensitive text. Blur and pixelation hide appearance, not information, and text is a worst case because a screenshot uses one known font and a small alphabet, so an attacker can render guesses and match the blocks. Hide passwords, card numbers, account numbers, addresses, names and emails with a solid, fully opaque box.
What is Depix?
Depix is an open-source tool published in December 2020 by Sipke Mellema that recovered pixelated passwords from screenshots. It renders candidate strings in the same font, pixelates them with the same block grid and compares the blocks with the redacted image. It works best when blocks are small relative to the characters and the font is known.
How strong should a blur or pixelation be to hide a face?
A pixel block should be at least as large as the features that identify the subject, such as an eye or a mouth for a face, and a blur radius should be at least a few percent of the face width. If you can still make out the eyes and mouth, increase it, and make the area a little larger than the face.
Why is a black box in a PDF not always safe redaction?
Drawing a black rectangle in a PDF annotation, a slide or a layered image file often leaves the original content underneath, so removing the rectangle or copying the text below reveals everything. A semi-transparent highlighter can also be brightened back into readable text. Safe redaction replaces the pixels in a flat image with a fully opaque fill.
How can an image leak information after redaction?
An image can leak through Exif metadata such as GPS coordinates, camera serial number and capture time, through second copies of the same detail elsewhere in a screenshot, and through reflections in sunglasses, windows and monitors. People can also be recognised by clothing, tattoos, a car or the background, even with a perfectly blurred face.
Checksums vs Digital Signatures: How to Verify What You Download
What is the difference between a checksum and a digital signature?
A checksum proves a file's bytes are unchanged, while a digital signature also proves who published it. Anyone, including an attacker, can compute a checksum, so a match only rules out tampering if the expected hash came from a trusted channel. A signature binds the bytes to a private key only the publisher holds, and you verify it with their public key.
How do I verify a SHA-256 checksum?
Compute the file's SHA-256 and compare it with the expected value: sha256sum file on Linux, shasum -a 256 file on macOS, certutil -hashfile file SHA256 in Windows cmd or Get-FileHash file -Algorithm SHA256 in PowerShell. sha256sum -c SHA256SUMS checks a whole list. Get the expected hash from somewhere other than the download server, such as a signed manifest.
Is MD5 still safe for checksums?
MD5 and SHA-1 are broken for collision resistance, meaning researchers can build two different files with the same digest, so they are unsafe for signatures or anything an attacker controls. They still catch random corruption, which is why old mirrors publish MD5 sums. SHA-256 is the sensible default for checksums, and SHA-384 and SHA-512 are fine too.
How can I tell which hash algorithm a checksum uses?
The length of the hex string usually tells you: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. Hex comparison should ignore case and separators, so an uppercase SHA-256 value copied from PowerShell matches the same lowercase value from Linux.
What tools are used to sign software releases?
GnuPG, used as gpg --verify file.asc file, is the traditional choice for Linux distributions. minisign uses Ed25519 with a very small key format, and Sigstore's cosign signs container images and other artifacts. Each relies on the same idea: a public key you trust and a signature over the exact bytes of the release.
Comparing Hash Algorithms: Security Margins, Speed and the Keccak Trap
What is a birthday attack on a hash function?
A birthday attack finds two inputs with the same digest by generating digests until any two match. Because of the birthday paradox, it costs only about 2^(n/2) attempts for an n-bit hash, rather than the 2^n needed to match a given digest. In a room of 23 people there is a better than even chance that two share a birthday.
What is a length extension attack?
A length extension attack exploits Merkle-Damgård hashes such as MD5, SHA-1, SHA-256 and SHA-512, where the digest is the internal state. If a system signs with hash(secret + message), an attacker who knows the digest and secret length can append data and compute a valid digest without the secret. SHA-384 and SHA-3 resist it, and HMAC is the real fix.
How can I identify a hash algorithm from its length?
A hex digest has four bits per character, so its length gives away the digest size. A 32-character hex hash is almost always MD5, 40 characters is SHA-1 (or RIPEMD-160), 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512 or Keccak-512.
How was SHA-1 broken?
SHA-1 was weakened on paper in 2005. In February 2017 Google and CWI Amsterdam published SHAttered, two different PDF files with the same SHA-1 digest, at a cost of roughly 2^63 operations. In 2020 Gaëtan Leurent and Thomas Peyrin showed a chosen-prefix collision, which lets an attacker forge certificates and PGP keys, for about US$45,000 of GPU time.
Is MD5 still secure?
No. MD5 has been broken for collisions since Xiaoyun Wang and colleagues published them in 2004, and an MD5 collision now takes seconds on a laptop. MD5 still works as a checksum against accidental corruption, for cache keys and for deduplication inside one trusted system, but not for signatures, certificates or download integrity where an attacker can choose inputs.
Debugging SAML SSO: Decoding Requests, Responses and Bindings
What is the difference between a SAML service provider and identity provider?
In SAML single sign-on, the Service Provider (SP) is the application that wants to know who the user is, and the Identity Provider (IdP), such as Okta, Microsoft Entra ID, Google Workspace, Keycloak or ADFS, authenticates the user. The SP sends an AuthnRequest, and the IdP replies with a Response containing an Assertion about the user.
Why does a SAML login fail?
Most SAML login failures show up in a few fields of the decoded SAMLResponse. Check that StatusCode is Success, that Destination exactly equals the expected ACS URL, that Audience equals the SP's entity ID, that InResponseTo matches a request the SP sent, and that the NotBefore and NotOnOrAfter window is not broken by clock skew between servers.
What does InResponseTo mean in a SAML response?
InResponseTo is the field in a SAML Response that must match the ID of an AuthnRequest the service provider actually sent. The check fails if the session that stored the request ID was lost. In IdP-initiated flows, where the user starts at the identity provider's portal, only the Response exists and it has no InResponseTo value.
What is an XML signature wrapping attack in SAML?
An XML signature wrapping attack is one where an attacker moves a signed element and inserts an unsigned one that the application reads instead. Such attacks have hit real SAML libraries. The defence is to use a maintained library, validate the schema, and read only the assertion that the signature actually covers, since a signature being present is not the same as it being valid.
Why did SAML logins stop working after a certificate rotation?
Identity providers rotate their signing certificates, and if the service provider still has the old certificate configured, signatures stop verifying and logins fail from a specific date. Compare the certificate in the IdP metadata with the one the SP has configured, checking the validity dates and fingerprint of each, for example with the X.509 Certificate Parser.
EXIF Data in Photos: What It Reveals and How to Remove It
What is EXIF data?
EXIF, the Exchangeable image file format, is metadata stored inside a photo file. It records the device make and model, exposure settings such as ISO, aperture and shutter speed, the date and time, and often GPS latitude, longitude and altitude. JEIDA started the standard in 1995, and CIPA and JEITA now maintain it, with version 3.0 published in 2023.
Which apps strip EXIF metadata from photos?
Large social networks such as Facebook, Instagram and X typically strip EXIF from the public copy on upload, and messaging apps often recompress and strip photos on a normal send. Email attachments, cloud drive links, AirDrop and USB transfers keep the original file with metadata intact, while forums, marketplaces and small sites vary. Behaviour changes over time, so test your own route.
How do I convert EXIF GPS coordinates to decimal?
EXIF stores GPS coordinates as degrees, minutes and seconds plus a hemisphere letter. The decimal value is degrees + minutes / 60 + seconds / 3600, negated for south latitudes and west longitudes. For example, 55 degrees 2 minutes 19.521 seconds North and 8 degrees 27 minutes 25.886 seconds East become 55.038756 and 8.457191.
Can EXIF data be trusted as evidence?
No. EXIF is just bytes that software wrote, and every field can be edited with a single command, so dates and camera models are clues to cross-check, never proof. Timestamps can also simply be wrong: one test file has a ModifyDate of 2013:05:26 16:05:92, with 92 seconds, which no clock produces.
Where is EXIF stored in a JPEG file?
In a JPEG, EXIF lives in the APP1 segment near the start of the file, before the compressed image data. The segment begins with the ASCII text Exif and a small TIFF header, followed by linked directories: IFD0 for basic device tags, an Exif sub-IFD for exposure and time, and a GPS sub-IFD for location. Removing it does not touch image quality.
HMAC Signatures Explained, with GitHub, Stripe and Slack Webhooks
How does HMAC work?
HMAC, defined in RFC 2104 in 1997, hashes twice with two keys derived from one secret: HMAC(K, m) = H((K′ ⊕ opad) ‖ H((K′ ⊕ ipad) ‖ m)). K′ is the key padded or hashed to the block size, ipad is the byte 0x36 repeated and opad is 0x5c. The outer hash hides the inner state, so length-extension attacks cannot work.
How do I verify a Stripe webhook signature?
Stripe signs the string <timestamp>.<raw body> with HMAC-SHA256, where the timestamp is the t value from the Stripe-Signature header and the v1 value is the expected hex signature. During secret rotation there may be more than one v1, so accept the request if any matches. Stripe's libraries reject events more than five minutes old by default.
How do I verify a Slack request signature?
Slack signs the string v0:<timestamp>:<raw body> with HMAC-SHA256, taking the timestamp from the X-Slack-Request-Timestamp header, and sends the result as X-Slack-Signature: v0=<hex>. Slack's documentation also says to reject requests whose timestamp is more than five minutes from your clock, which blocks replays of old requests.
What is a timing-safe comparison for HMAC signatures?
A timing-safe comparison examines every byte, unlike ==, which usually stops at the first difference and lets an attacker measure response times to recover a signature byte by byte. Use crypto.timingSafeEqual in Node.js, hmac.compare_digest in Python, hash_equals in PHP, hmac.Equal in Go or MessageDigest.isEqual in Java.
Does HMAC encrypt the message?
No. An HMAC proves that someone holding the key produced the message and that it was not modified, but the body travels in clear unless you also use TLS or encryption. HMAC also cannot prove which party signed, since both sides hold the same key, and it does not stop replay unless a timestamp or unique ID is included in the signed data.
How JWTs Work: Decoding Headers, Payloads and Claims
What is the difference between decoding and verifying a JWT?
Decoding a JWT just reads its Base64URL-encoded header and payload, needs no key, and tells you what the token claims. Verifying checks the signature with the right key, using an algorithm allow-list set by the server, then checks exp, nbf, iss and aud. Only verification shows the claims came from someone you trust and were not changed.
What is the JWT alg none vulnerability?
The JWT specification allows unsigned tokens, and early libraries accepted a token whose header said "alg": "none" with no signature, which let anyone forge one. The fix is to never let the token header decide the algorithm: always reject none and verify against an allow-list the server configures, for example only RS256.
What is a JWT algorithm confusion attack?
In a JWT algorithm confusion attack, a server uses RS256 but lets the token header choose the algorithm. An attacker switches the header to HS256 and signs the token with the server's public key as the HMAC secret, and libraries that trusted the header would verify it. Pinning the expected algorithm on the server prevents the attack.
Should I use sessions or JWTs for authentication?
JWTs suit stateless verification across services, because any service with the public key can check a token without calling the identity provider. The trade-off is revocation: a signed token stays valid until exp, so instant logout needs short lifetimes plus refresh tokens or a jti deny-list. For a single web application, a server-side session cookie is often simpler.
Why does every JWT look like it expired in 1970?
JWT times such as exp are Unix timestamps in seconds, not milliseconds. Comparing exp with JavaScript's Date.now(), which returns milliseconds, is a very common bug that makes every token look like it expired in 1970. Compare exp with the current Unix time in seconds, or paste the value into an epoch converter to read it.
How to Read an X.509 Certificate and Debug a TLS Chain
Does a wildcard certificate cover the root domain?
No. A wildcard such as *.example.com covers exactly one label in the left-most position, so it matches www.example.com and api.example.com but not example.com, which has no label to replace, and not a.b.example.com, which has two. That is why most certificates list both the bare domain and the wildcard in their Subject Alternative Name extension.
How do I fix a missing intermediate certificate?
Configure the server to send the leaf certificate followed by each intermediate in order, for example by pointing it at fullchain.pem rather than cert.pem with Certbot. Desktop Chrome often hides the problem by fetching the issuer through the AIA URL, but many mobile apps, curl, Java and Python clients fail with "unable to get local issuer certificate".
How do I check a certificate's expiry date with OpenSSL?
Run openssl s_client -connect example.com:443 -servername example.com </dev/null and pipe the output into openssl x509 -noout -enddate -subject, which prints a notAfter= line in UTC. Adding -checkend 2592000 to the x509 command makes it exit with a non-zero status if the certificate expires within 30 days, which suits a cron job or CI check.
What is a Subject Alternative Name in a certificate?
The Subject Alternative Name (SAN) extension lists the DNS names and IP addresses a certificate is valid for, and it is the only field modern browsers match hostnames against. RFC 2818 deprecated Common Name matching in 2000 and Chrome 58 removed it in 2017. IP addresses need their own iPAddress entries rather than DNS entries.
How long can a TLS certificate be valid?
Public TLS certificates have been capped at 398 days since 1 September 2020 under the CA/Browser Forum Baseline Requirements. Ballot SC-081, passed in 2025, shortens the cap to 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029, making automated ACME renewal essential.
How TOTP 2FA Codes Work: RFC 6238 Step by Step
How does the TOTP algorithm work?
TOTP (RFC 6238) turns the current time into a counter, T = floor((Unix time − T0) / X), with T0 = 0 and X = 30 seconds by default, and then applies HOTP. HOTP computes HMAC-SHA1 of the shared secret and the 8-byte counter, dynamically truncates the 20-byte result to a 31-bit number, and takes it modulo 10^6 for a six-digit code.
What is the Base32 secret in a 2FA setup?
The Base32 secret is the text form of the shared secret behind a 2FA app, defined in RFC 4648: the letters A to Z and the digits 2 to 7, each standing for 5 bits. It is case-insensitive and avoids the easily confused 0, 1, 8 and 9. A typical 20-byte (160-bit) secret becomes 32 Base32 characters.
Can a TOTP code be used twice?
A TOTP code stays valid for the whole acceptance window, so an attacker who sees one could reuse it unless the server prevents it. RFC 6238 says the verifier must not accept the second attempt of the same OTP, so a server should remember the last time step used for each account and refuse any code for that step or earlier.
Does TOTP protect against phishing?
No. A fake login page can ask for the password and the current TOTP code and relay both to the real site within the 30-second window. Passkeys and FIDO2 security keys do stop this, because they are bound to the website's domain. Stolen server secrets and weak account recovery, such as SMS fallback, are the other realistic attacks on TOTP.
How do I implement TOTP on a server?
Generate a 20-byte secret from a cryptographic random source, show it as Base32 and a QR code, and require one valid code before enabling 2FA. Store the secret encrypted, accept the current step and one either side, compare in constant time, record the step used to block replays, rate-limit attempts, issue recovery codes, and verify the library against the RFC 6238 test values.
HTTP Security Headers: What to Send and What to Skip
What is needed to add a site to the HSTS preload list?
The HSTS preload list closes the gap on the very first visit, before a browser has seen the Strict-Transport-Security header. To submit a domain at hstspreload.org, the header needs a max-age of at least one year, includeSubDomains and the preload token. Only turn it on once every subdomain serves HTTPS, because removal from the preload list takes months to reach users.
What does X-Content-Type-Options nosniff do?
X-Content-Type-Options: nosniff stops browsers guessing that a file served as one type, such as text/plain, is really JavaScript or CSS. That blocks uploaded files from being executed as script or stylesheet. The header has only one valid value, nosniff, and it matters on every response, including API and static file responses, not just HTML pages.
What Referrer-Policy should I use?
Use strict-origin-when-cross-origin or something stricter. That policy, which is also the browser default, sends the full URL to your own origin, only the origin to other HTTPS sites, and nothing on a downgrade to HTTP. Avoid no-referrer-when-downgrade and unsafe-url, which send full paths and query strings to other sites and can leak reset tokens or search terms.
What is Content-Security-Policy-Report-Only?
Content-Security-Policy-Report-Only is a header that reports CSP violations without blocking anything, which makes rolling out a new policy easier. It is a migration step, not protection: a Report-Only policy on its own does not stop an injected script, and the Security Headers Analyzer flags it as weak. Leaving one in place for years blocks nothing.
What happens if a site sends two Content-Security-Policy headers?
Browsers enforce both Content-Security-Policy headers, and the effective policy is the intersection of the two. That often breaks the site in confusing ways, because a source must be allowed by both policies to load. Always check the response the public actually sees, since a CDN can also strip or override headers set in the app.
JSON Web Keys (JWK) Explained: Formats, JWKS and Thumbprints
What is a JWKS?
A JWKS, or JWK Set, is a JSON object with a keys array holding JSON Web Keys. Identity providers publish one at a well-known URL, listed as jwks_uri in OpenID Connect discovery, and every service that verifies their tokens downloads it. The verifier reads the kid in a JWT header, finds the key with that kid in the set and checks the signature.
How does JWKS key rotation work?
JWKS key rotation works by publishing the new key alongside the old one, switching signing to the new key, and removing the old key only after every token signed with it has expired. Verifiers should refetch the set once, with rate limiting, when they see a kid they do not know, rather than relying on a long cache.
What is the difference between JWK and PEM?
A JWK is a key written as a JSON object, with members such as kty, n and e holding base64url-encoded values. PEM is Base64 DER between BEGIN and END lines, and its label, such as PUBLIC KEY for SPKI or PRIVATE KEY for PKCS#8, names the ASN.1 structure inside. Most non-JavaScript tooling, including OpenSSL and nginx, wants PEM.
What does AQAB mean in a JWK?
AQAB is the base64url encoding of the bytes 01 00 01, which is 65537, the RSA public exponent almost every RSA key uses. It appears as the e member of an RSA JSON Web Key, alongside n, the modulus. JWK values are base64url, using - and _ instead of + and / with no padding.
Why does token verification fail with "no matching key found"?
"No matching key found" usually means the identity provider rotated its signing key, the new key has a new kid, and the verifier is still using a cached old key set. Decode the token header, note the kid, fetch the provider's JWKS and look for it. If it is missing, it is a caching or rotation problem.
MD5, SHA-256, SHA-3, BLAKE3 and CRC32: Choosing the Right Hash
What is the avalanche effect in hashing?
The avalanche effect means that changing even one bit of a hash function's input flips about half the bits of its output, so the new digest looks completely unrelated. Hashing hello and Hello with SHA-256, which differ in one bit of the first byte, gives two digests that share nothing recognizable.
What are the three properties of a cryptographic hash function?
A cryptographic hash function should have pre-image resistance, so you cannot find an input from its digest; second pre-image resistance, so you cannot find a different input with the same digest as a given one; and collision resistance, so you cannot find any two inputs with the same digest. Collision resistance is the first to fall as an algorithm ages.
Is CRC32 a cryptographic hash?
No. CRC32 is a cyclic redundancy check designed to detect accidental errors in transmission and storage, and it catches all burst errors up to 32 bits. It is used in ZIP archives, PNG chunks, gzip and Ethernet frames. Because CRC32 is linear, an attacker can modify data and fix up the CRC to match, so it cannot detect tampering.
How do I get the SHA-256 hash of a file?
On the command line, use sha256sum file on Linux, shasum -a 256 file on macOS or Get-FileHash file in PowerShell. The Hash Generator File tab does the same in the browser, reading the file in 4 MB slices, and can compare the result with a checksum you paste in.
Which hash algorithms does Bitcoin use?
Bitcoin uses SHA-256 for its proof of work, and its addresses are RIPEMD-160 of SHA-256. RIPEMD-160 survives today mainly in that role. Ethereum is different: its "SHA3" is actually Keccak-256, the original Keccak submission, which produces a different digest from the FIPS 202 SHA3-256 for the same input.
Password Strength and Entropy: What Crack-Time Estimates Mean
How does zxcvbn estimate password strength?
zxcvbn estimates strength by counting how many guesses an attacker would need, trying the most likely passwords first. Published by Daniel Lowe Wheeler of Dropbox at USENIX Security in 2016, it finds dictionary words, l33t variations, keyboard walks, sequences, repeats and dates, then picks the cheapest way to cover the whole password and reports that guess count.
What is the minimum password length in NIST SP 800-63B-4?
NIST SP 800-63B-4, the 2025 revision, says verifiers shall require at least 15 characters when the password is the only authenticator, and at least 8 when it is one factor of a multi-factor login. They should allow at least 64 characters, accept spaces and Unicode, and check new passwords against a blocklist of common or compromised values.
Is a passphrase stronger than a complex password?
A random passphrase is usually stronger than a decorated word. zxcvbn rates correct horse battery staple at about 67 realistic bits, while Tr0ub4dor&3 costs fewer than a million guesses, about 19.5 bits. Words picked at random from the 7,776-word EFF long list add about 12.9 bits each, so five words give about 64.6 bits.
How much faster is cracking SHA-1 than bcrypt?
In zxcvbn's standard attack speeds, an offline attacker guesses about 10 billion passwords per second against a fast unsalted hash such as MD5 or SHA-1, but only about 10,000 per second against a slow hash such as bcrypt, scrypt, Argon2id or PBKDF2. So the same password can be fine or hopeless depending on how the site stores it.
How do I check if my password has been in a breach?
Have I Been Pwned's Pwned Passwords service checks a password against hundreds of millions of breached passwords. It uses a k-anonymity design, so the browser sends only the first five hex characters of the password's SHA-1 hash, never the password itself. A common-password list in a strength meter is far smaller, so passing it is necessary but not sufficient.
Port Scanning Explained: Open, Closed and Filtered Ports
What is a port in networking?
A port is a 16-bit number from 0 to 65535, carried in the TCP or UDP header, that directs a packet to a particular program on a machine, while the IP address gets it to the machine. Ports 0 to 1023 are well-known ports assigned by IANA, 1024 to 49151 are registered, and 49152 to 65535 are dynamic.
What is the difference between a SYN scan and a connect scan?
A connect scan opens a normal TCP connection with the connect() system call, needs no special privileges, but completes the handshake so the application may log it. A SYN scan, or half-open scan, crafts the SYN packet itself and answers a SYN-ACK with RST. It is faster and quieter, but needs root or administrator rights.
Why are UDP port scans slow and often show open|filtered?
UDP has no handshake, so an open UDP port often sends nothing back, and the only definite signal is an ICMP "port unreachable" message from a closed port. Many hosts rate-limit those ICMP messages, which slows the scan. When no reply arrives, the scanner cannot tell an open port from a filtered one, so it reports open|filtered.
Which ports should not be open to the internet?
Database and cache ports should almost never face the internet: MySQL on 3306, PostgreSQL on 5432, Redis on 6379 and MongoDB on 27017. RDP on 3389 belongs behind a VPN, and SSH on 22 is best restricted by source IP. Only web servers need 80 and 443 open, and only mail or DNS servers need 25 or 53.
Preventing SQL Injection: Spotting Unsafe Queries in Code Review
Why does SQL injection happen?
SQL injection happens when an application builds a SQL statement by pasting user input into the text, so the database cannot tell which characters were meant as code and which as data. A quote, a semicolon or a comment marker in the input can then change the structure of the statement. Injection is listed at A03 in the OWASP Top 10 2021.
How do I safely use a dynamic ORDER BY column?
Placeholders bind values, not identifiers, so an ORDER BY column cannot be a parameter. Map the user's input to an allow-list of known column names, and accept only ASC or DESC from a fixed set for the sort direction. ORDER BY ${sort} stays dangerous even when every WHERE value in the same query is bound.
How do I use parameters with a SQL IN list?
Use one placeholder per item in a SQL IN list, generating $1, $2, $3 and so on from the array's length, and pass the values separately. In PostgreSQL, an alternative is = ANY($1) with the whole array bound as a single parameter. Never join the values into the SQL text with commas.
Do ORMs prevent SQL injection?
ORMs such as Prisma, SQLAlchemy, Hibernate, Eloquent and Entity Framework parameterise their query builders for you. Each also has a raw-SQL escape hatch, such as $queryRawUnsafe, text(), createNativeQuery, DB::raw or FromSqlRaw, and those are where string-built queries come back in. Review every use of them, because one interpolated string undoes the ORM's protection.
Do stored procedures prevent SQL injection?
Stored procedures only help if they do not build dynamic SQL inside with EXEC or EXECUTE on concatenated strings, which simply moves the same injection bug into the database. Bound parameters remain the primary defence. Running the application with a least-privilege database account that cannot drop tables also limits the damage when something slips through.
RSA vs ECDSA vs Ed25519: Choosing and Formatting Key Pairs
How many bits of security does RSA 2048 have?
RSA 2048 provides 112 bits of security under NIST SP 800-57 Part 1. Reaching 128 bits needs a 3072-bit RSA modulus, the same strength as a 256-bit elliptic curve key such as P-256 or Ed25519. NIST's transition guidance allows 112-bit strength, and therefore RSA 2048, only through 2030.
What is the ECDSA nonce reuse problem?
ECDSA needs a fresh secret random number k for every signature, and if k is ever reused or even slightly biased, the private key can be computed from the signatures. In 2010 the fail0verflow group recovered Sony's PlayStation 3 signing key because the same k was used every time. RFC 6979 derives k deterministically, and Ed25519 builds that idea into the standard.
Which key type should I use for a TLS certificate?
ECDSA P-256 is widely supported and makes TLS handshakes smaller, while RSA 2048 or 3072 gives maximum compatibility. Ed25519 is a strong choice for SSH, but Ed25519 certificates are not accepted by browsers, so it is not an option for public TLS certificates.
What is a JWK thumbprint?
A JWK thumbprint, defined in RFC 7638, is the SHA-256 hash of a key's required JWK members in a fixed order, Base64url-encoded. Many identity providers use the thumbprint as the key ID (kid), so the ID is derived from the key itself and cannot drift out of step with it.
Are RSA and ECDSA keys safe against quantum computers?
No. RSA and elliptic curve keys, including Ed25519, would all fall to a large fault-tolerant quantum computer running Shor's algorithm. NIST published the first post-quantum signature standards, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), in 2024, but they are not yet usable in browsers' Web Crypto or in most SSH and certificate tooling.
Strong Passwords, Explained: Length, Entropy and What NIST Actually Recommends
What are the NIST password guidelines?
NIST SP 800-63B, revised in 2017, says to favour length, requiring at least 8 characters for user-chosen passwords and allowing at least 64. It drops composition rules, stops forced rotation unless there is evidence of compromise, screens new passwords against breached and common ones, and allows paste so password managers work.
Is a passphrase better than a random password?
A random passphrase is a good choice for the few passwords you must type or remember, such as a computer login or password manager master password. Each word picked at random from the 7,776-word Diceware list adds about 12.9 bits, so six words give about 77 bits. For every other account, a long random password stored in a password manager works best.
How many bits of entropy does a password need?
Around 80 bits of true randomness puts a password out of reach of brute force with current hardware, even in an offline attack on fast hashes. A random 14 to 16 character password reaches that level. A random 16-character password drawn from 88 letters, digits and symbols has about 103 bits, since each character adds about 6.46 bits.
Why should password generators not use Math.random()?
JavaScript's Math.random() is a fast pseudo-random generator built for games and animations, not for being unpredictable to an adversary. Passwords should come from crypto.getRandomValues(), which draws from the operating system's cryptographically secure source. The RedBison Password Generator uses it with rejection sampling, so modulo bias is avoided and every character is equally likely.