A penetration tester discovered a code repository and noticed passwords were hashed before they were stored in the database with the following code: salt = 'saltl23' hash =…

Question

Options

• AChanging passwords that were created before this code update
• BKeeping hashes created by both methods for compatibility
• CRehashing all old passwords with the new code
• DReplacing the SHA-256 algorithm to something more secure

• A
  72% (43)
• B
  8% (5)
• C
  3% (2)
• D
  17% (10)

Explanation

The penetration tester recommended the code be updated to use a random salt instead of a fixed salt for hashing passwords. A salt is a random value that is added to the plaintext password before hashing it, to prevent attacks such as rainbow tables or dictionary attacks that rely on precomputed hashes of common or weak passwords. A random salt ensures that each password hash is unique and unpredictable, even if two users have the same password. However, changing the salt does not affect the existing hashes that were created with the old salt, which may still be vulnerable to attacks. Therefore, the penetration tester should recommend changing passwords that were created before this code update, so that they can be hashed with the new salt and be more secure.

No community discussion yet for this question.