Password Storage Rating

How securely do they store user passwords & how good are they at letting us know? And how do *you* store passwords? A project by Michal Špaček @spazef0rze

[Password Storage Rating @PasswordStorage]

Need to rehash or upgrade existing password hashes? Here's how you should do it, by @spazef0rze: https://t.co/RCRUV3nuDb

[Password Storage Rating @PasswordStorage]

@roman3349 Potvrzuju. To už není ani vtipný :-(

[Password Storage Rating @PasswordStorage]

"We don't have a password complexity policy. Passwords are encrypted with salt and SHA-256."
-- @Jotform

You don't encrypt passwords for authentication, you hash them. Luckily, SHA-256 is a hashing algorithm 👍 but it's not suitable for passwords 👎
https://t.co/aB9fqvYOQX

[Password Storage Rating @PasswordStorage]

The folks behind Slab, the knowledge base & wiki app, created a nice page where they share many security-related things including that they store passwords hashed with bcrypt: https://t.co/ta4uFWwXup Thumbs up for the transparency @slab & for bcrypt too!
https://t.co/6hTaBczWJN

[Password Storage Rating @PasswordStorage]

"deSEC is a free DNS hosting service, designed with security in mind" (their words) and they use "PBKDF2-based password hashing to secure your sensitive information" (also their words). Nice job @desec_io! (my words this time) 😊 https://t.co/Iw873uGFfb

[Password Storage Rating @PasswordStorage]

The company was using unsalted SHA-1 and we migrated to bcrypt (also rehashed existing hashes, see the pinned tweet) and I thought it might be a good idea to tell the world and maybe inspire others to do the same. https://t.co/HO080al5S3

[Password Storage Rating @PasswordStorage]

5 years of password hashing disclosures here on Twitter 😅

[Password Storage Rating @PasswordStorage]

The project itself was launched in 2016 in this talk at @BSidesLV https://t.co/PfMJgOJNSx (waving at @thorsheim 👋) and the idea itself dates back to 2014 when I gave a talk about improving security at a company I was working for back then.

[Password Storage Rating @PasswordStorage]

MangaDex has reached out and asked me to add their password storage disclosure announcement, very cool! Thanks @MangaDexRE & Tristan 👍 They use PBKDF2 now but some records use bcrypt and Argon2id historically.

https://t.co/4X2WdfjINL

[Password Storage Rating @PasswordStorage]

OrgPad, a brainstorming tool, is using PBKDF2 with BLAKE2b to hash passwords. They disclose it publicly on their site and here on Twitter too. And they also have @securitytxt 😍 Good job @orgpad_official, thank you! https://t.co/JauFTmSNgl

[Password Storage Rating @PasswordStorage]

@JakubBoucek Ouch :(

[Password Storage Rating @PasswordStorage]

Unfortunately Czech Railways don't use bcrypt in all their apps. Another app doesn't use hashing at all but instead uses encryption. I really hope they'll start doing what they should and that I'll be able to update the grade soon 🤞 https://t.co/oU6Me3k9Jf

[Password Storage Rating @PasswordStorage]

Czech Railways, the largest Czech railway carrier have confirmed (although very unofficially) they use bcrypt for user passwords in one of their apps. Previously, they were using SHA-512 so switching to bcrypt is a very good news & very good job!
https://t.co/rNF96jUwYY

[Password Storage Rating @PasswordStorage]

Good job @Vyfakturuj_cz @SimpleShop_cz @redbitcz and thanks for that!

Noted: https://t.co/6TQ8vidS9c

[Ⓙakub Ⓑouček @JakubBoucek]

🎉 I am happy to announce the @Vyfakturuj_cz and @SimpleShop_cz apps from @redbitcz team are now hash all user's passwords with the Bcrypt algorithm and fully support future upgrades (rehash).
➡️ @PasswordStorage

[Password Storage Rating @PasswordStorage]

@JakubBoucek @Vyfakturuj_cz @SimpleShop_cz @redbitcz Any docs link? I'd like to give you A :-) https://t.co/or2EXdOtKm

[Password Storage Rating @PasswordStorage]

@MONETAMoney Thank you and thanks for getting back to me. I've updated the record, nice grade, congrats! :-) https://t.co/wjmADmODta

[Password Storage Rating @PasswordStorage]

There's another bank disclosing how they store user passwords. @MONETAMoney says they use Argon2 and they have also included the info in their FAQ! They now score A, good job!

(They even @-me and thanked me 😇)

https://t.co/iXDY7Q6WRh

[Password Storage Rating @PasswordStorage]

Bank admits they store passwords encrypted, not hashed, after customers started receiving passwords they created printed out via mail. Not cool @MONETAMoney but at least they say they'll move to hashing eventually. Looking forward to upgrade the score!
https://t.co/iXDY7Q6WRh

[Password Storage Rating @PasswordStorage]

@MONETAMoney Previously, the bank admitted they store encrypted but promised to switch to hashing. Nice to see the promised fulfilled in some 3 months, thank you. (You may still see F in the thumbnail here until the cache is refreshed)

https://t.co/jUbr7vZEq4

[Password Storage Rating @PasswordStorage]

Bank admits they store passwords encrypted, not hashed, after customers started receiving passwords they created printed out via mail. Not cool @MONETAMoney but at least they say they'll move to hashing eventually. Looking forward to upgrade the score!
https://t.co/iXDY7Q6WRh

[Password Storage Rating @PasswordStorage]

There's another bank disclosing how they store user passwords. @MONETAMoney says they use Argon2 and they have also included the info in their FAQ! They now score A, good job!

(They even @-me and thanked me 😇)

https://t.co/iXDY7Q6WRh

[MONETA Bank @MONETAMoney]

@PasswordStorage Hello Michal, as part of our upgrade of Internet Banka, @MONETAMoney uses Argon2 for storing clients’ passwords since April. We disclosed this in FAQs: https://t.co/t3OtaFFKyk. Like @komercka, we’d like to express our appreciation of your work in making internet a better place.

[Password Storage Rating @PasswordStorage]

Another company publishing they use bcrypt, cool @agilebase @agileChilli! And even their CTO @okohll DMing me to add them, good job 👍 https://t.co/6jjPLKbZXx

[Password Storage Rating @PasswordStorage]

Czech news portal @infocz_web uses bcrypt cost 12 to hash passwords and their Head of Digital and Technology @adent has happily tweeted it himself too. Thank you 👍 https://t.co/YhpTma6LaN