Password Storage Rating @PasswordStorage

How securely do they store user passwords & how good are they at letting us know? And how do *you* store passwords? A project by Michal Špaček @spazef0rze pulse.michalspacek.cz/passwords/stor… In your questions, asking Joined February 2018

Tweets

169
Followers

443
Following

1
Likes

46

Password Storage Rating @PasswordStorage

2 years ago

"We don't have a password complexity policy. Passwords are encrypted with salt and SHA-256." -- @Jotform You don't encrypt passwords for authentication, you hash them. Luckily, SHA-256 is a hashing algorithm 👍 but it's not suitable for passwords 👎 pulse.michalspacek.cz/passwords/stor…

0 2 3 1K 2

Password Storage Rating @PasswordStorage

2 years ago

The folks behind Slab, the knowledge base & wiki app, created a nice page where they share many security-related things including that they store passwords hashed with bcrypt: slab.com/security/#encr… Thumbs up for the transparency @SLAB & for bcrypt too! pulse.michalspacek.cz/passwords/stor…

0 0 5 2K 0

Password Storage Rating @PasswordStorage

2 years ago

"deSEC is a free DNS hosting service, designed with security in mind" (their words) and they use "PBKDF2-based password hashing to secure your sensitive information" (also their words). Nice job @desec_io! (my words this time) 😊 pulse.michalspacek.cz/passwords/stor…

0 1 3 897 0

Password Storage Rating @PasswordStorage

3 years ago

MangaDex has reached out and asked me to add their password storage disclosure announcement, very cool! Thanks @MangaDexRE & Tristan 👍 They use PBKDF2 now but some records use bcrypt and Argon2id historically. pulse.michalspacek.cz/passwords/stor…

0 0 2 204 0

Password Storage Rating @PasswordStorage

4 years ago

OrgPad, a brainstorming tool, is using PBKDF2 with BLAKE2b to hash passwords. They disclose it publicly on their site and here on Twitter too. And they also have @securitytxt 😍 Good job @orgpad_official, thank you! pulse.michalspacek.cz/passwords/stor…

0 1 5 0 0

Password Storage Rating @PasswordStorage

4 years ago

Good job @Vyfakturuj_cz @SimpleShop_cz @redbitcz and thanks for that! Noted: pulse.michalspacek.cz/passwords/stor…

[email protected] @JakubBoucek

4 years ago

Good job @Vyfakturuj_cz @SimpleShop_cz @redbitcz and thanks for that! Noted: pulse.michalspacek.cz/passwords/stor…

2 0 2 0 0

0 0 3 0 0

MONETA Bank @MONETAMoney

4 years ago

@PasswordStorage Hello Michal, as part of our upgrade of Internet Banka, @MONETAMoney uses Argon2 for storing clients’ passwords since April. We disclosed this in FAQs: moneta.cz/caste-dotazy/o…. Like @komercka, we’d like to express our appreciation of your work in making internet a better place.

2 1 8 0 0

Password Storage Rating @PasswordStorage

4 years ago

Another company publishing they use bcrypt, cool @agilebase @agileChilli! And even their CTO @okohll DMing me to add them, good job 👍 pulse.michalspacek.cz/passwords/stor…

0 2 2 0 0

Password Storage Rating @PasswordStorage

4 years ago

Czech news portal @infocz_web uses bcrypt cost 12 to hash passwords and their Head of Digital and Technology @adent has happily tweeted it himself too. Thank you 👍 pulse.michalspacek.cz/passwords/stor…

0 1 2 0 0

Password Storage Rating @PasswordStorage

5 years ago

I've added sorting and search, a feature some of you have requested quite a few times – and rightfully so, there's now 130+ sites that have somehow disclosed their password storage. Match highlighting and what not, it's all there! :-)

0 0 3 0 1

Download Image

Password Storage Rating @PasswordStorage

5 years ago

Basecamp uses bcrypt cost 10 to hash user passwords for both @basecamp and their email service @heyhey. And they're not afraid to tell us in their security overview PDFs, nice job! Also their CTO @dhh has no problem to tweet the info when asked, cool 👍 pulse.michalspacek.cz/passwords/stor…

0 5 14 0 1

Password Storage Rating @PasswordStorage

5 years ago

CTemplar, encrypted email service, says they use bcrypt to hash user passwords. Good job, @RealCTemplar! (Put the info in your privacy policy for example, to get A) pulse.michalspacek.cz/passwords/stor…