#password hashing

At System76, we pride ourselves on making computers by nerds, for nerds. Our dedicated group of engineers work hard to create the best solutions for like-minded professionals, including on our website.

Today, we’re happy to announce new security updates for all system76.com accounts in the form of Recognizer, our open source authenticator service. The most notable changes this tool brings are the introduction of two-factor authentication and an upgrade in password hashing to further protect your login credentials. These updates, releasing this Thursday (February 11th 2021), will substantially increase security and make our site more flexible as we grow. Once the update is released, all users will be required to reset their password.

Two-Factor Authentication

Setting up two-factor authentication protects your account in the event that someone gets ahold of your login credentials. Beginning Thursday, February 11th, you can turn on 2FA by signing in to your system76.com account. From there, go to the Account Details page, where you’ll find the Two-Factor Authentication section. Follow the instructions to link your account with your third-party authentication app, such as Google Authenticator or 1Password.

Under the hood, System76 uses the Erlang ‘pot’ library, which generates RFC 6238 time based one-time tokens compatible with these third-party apps. Our authentication system also uses OAuth2.0 and JSON Web Token (JWT), two secure industry standards for authorization flows and communication between systems. The use of OAuth2.0 opens up the door for the potential to sign in with a third party, or even Pop!_OS, using a “Log In with System76” button; though for now, it’s only being used with System76 projects.

Password Hashing

Another piece within Recognizer is the migration to Argon2 password hashing. In addition to sounding delicious, password hashing is a secure way to store passwords for when you want to access your account at login. Passwords are transformed into a long string of characters that cannot be converted back to your actual password. A “salt” is added for further security, which adds a random set of characters to your password hash. This ensures your password is linked solely to your account, even in the event that another account uses the same password as you. Lastly, we increased our password requirements to include a minimum character length, special characters, capital letters, and numbers.

While your passwords have always been stored safely, we’re taking this opportunity to move to a newer and stronger algorithm. We chose Argon2 for its modern hashing technique and resilience to new attack methods. It also has a standard format for storing the hash, salt, and parameters as a single string, making it easy to change hashing options in the future without having to force a password reset. However, because existing passwords are currently hashed using an alternative algorithm, all existing users will need to reset their passwords to migrate their accounts over to this new algorithm on Thursday, February 11th.

Open Source Security Measures

System76 has always led by example with open source solutions. So far, we’ve open sourced our Protobuf messages, our notification microservice, and our Zendesk integration. The newest addition, Recognizer, is written in Elixir, styled in Bulma, and released under a GPLv3 license.

Password salting is most commonly found within Linux operating systems, and it is generally considered a more secure password encryption model than any of the models used within the various Microsoft distributions.

What is Password Salting?

Password salting is a technique to protect passwords stored in databases by adding a string of 32 or more characters and then hashing them. Salting prevents hackers who breach an enterprise environment from reverse-engineering passwords and stealing them from the database.

Password salting increases password complexity, making them unique and secure without affecting user experience. It also helps prevent hash table attacks and slows down brute-force and dictionary attacks.

TechStuff Explains Password Salting :

When a username has been established, the user typically creates a password to associate with this username. After the user has submitted the password to the salt-enabled system, the system appends the password to the username. Then, the new string of characters is hashed. This is a very effective way of encrypting passwords because even if two different users coincidentally select the same password, their usernames will almost certainly be different, thereby resulting in a different hash value.

Password hashing and why salting is required?

Hashing prevents passwords from being exposed or stolen by threat actors, since they are not stored as plaintext. For example, when users create an account with a username and password on a website, their password is hashed and stored in an internal file system in an encrypted form.

The Most Common Password Hashing Methods For Securing Your Ecommerce Platform

In 2018 password hashing is becoming more important than ever for both ecommerce website owners and people who provide commercial software applications.

Protecting your users’ data is no longer a suggestion, rather, it is a requirement as consumers are beginning to consider their security and the safety of their data a top priority.

As ecommerce continues to grow at a solid rate, with ecommerce…

표준화된 비밀번호 해싱 알고리즘을 찾기 위한 PHC(Password Hashing Competition)에서 우승을 차지한 알고리즘 Argon2. 표준으로 제정되기 위한 절차를 밟기 위해 IETF에 draft를 제출했다고 한다.

기존에도 널리 쓰이고 있는 bcrypt나 메모리 사용량을 의도적으로 늘릴 수 있는 scrypt가 있지만, 쉽게 구현할 수 있다는 편리성이 Argon2의 가장 큰 장점인 듯. 

Hashing Password in PHP 5.5 with Password Hashing API

View more