{"action":"opened","issue":{"url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5","repository_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes","labels_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5/comments","events_url":"https://api.github.com/repos/makersphereHQ/emoji-passcodes/issues/5/events","html_url":"https://github.com/makersphereHQ/emoji-passcodes/issues/5","id":177575738,"number":5,"title":"Use jsSHA with Increased Number of Rounds","user":{"login":"DaKnOb","id":743648,"avatar_url":"https://avatars.githubusercontent.com/u/743648?v=3","gravatar_id":"","url":"https://api.github.com/users/DaKnOb","html_url":"https://github.com/DaKnOb","followers_url":"https://api.github.com/users/DaKnOb/followers","following_url":"https://api.github.com/users/DaKnOb/following{/other_user}","gists_url":"https://api.github.com/users/DaKnOb/gists{/gist_id}","starred_url":"https://api.github.com/users/DaKnOb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DaKnOb/subscriptions","organizations_url":"https://api.github.com/users/DaKnOb/orgs","repos_url":"https://api.github.com/users/DaKnOb/repos","events_url":"https://api.github.com/users/DaKnOb/events{/privacy}","received_events_url":"https://api.github.com/users/DaKnOb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-17T13:26:10Z","updated_at":"2016-09-17T13:26:10Z","closed_at":null,"body":"When hashing something, for example a password, it is a good practice to hash it more than one time so as to increase the work an attacker has to do assuming they receive the hash. In this program, while you may not be storing these passwords and risking them being leaked, you provide a service similar to the [Bitcoin Brainwallet](https://en.bitcoin.it/wiki/Brainwallet). The most popular solution of this software used a single iteration of SHA-2 to create the wallet's private key. This lead to many people brute forcing all passwords up to a few characters and storing their private keys beforehand, allowing them to steal all the BTC from people using weak passwords.\r\n\r\nA good solution to slow attackers down / prevent them from getting up to large lengths of passwords is to use multiple iterations of the hashing algorithm. For example, if instead of a single SHA-512 that's being used currently, you did 1,000 or 5,000 or 10,000 iterations, it would increase the cost of the attacker 1,000 or 5,000 or 10,000 times respectively. Now keep in mind this also slows down by the same factor all the legitimate users, so you may want to play with this until you arrive at the correct value. The general recommendation is \"As much as you can afford\". \r\n\r\n[jsSHA already has a `numRounds` parameter that you can pass](https://github.com/Caligatio/jsSHA#hashing) to achieve this, however its internal workings are unknown to me, therefore I cannot guarantee its efficiency / security. However, it is a good start that can help you enhance your product's security very quickly."}}
{"actor":{"display_login":"DaKnOb"}}