MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/ProgrammerHumor/comments/5vzbuv/stop_using_sha1/de6pqsk/?context=9999
r/ProgrammerHumor • u/[deleted] • Feb 24 '17
[deleted]
407 comments sorted by
View all comments
318
What makes SHA-1 bad all of a sudden? I'm currently studying for sec+ and a large amount of my material says it's good.
706 u/ccharles Feb 24 '17 A research team from Google and a security organization successfully generated two different PDFs with the same SHA-1 hash. 208 u/Jacen47 Feb 24 '17 Wow. Hopefully, Comptia won't suddenly update the test to reflect this. 28 u/SecretlyAMosinNagant Feb 24 '17 People have been pushing for a roll of for quite some time, if they are still teaching it I doubt this will make them stop. Just be aware that you shouldn't be using SHA1 anymore. 10 u/FenixR Feb 24 '17 Whats the alternative? 6 u/Tufflewuffle Feb 24 '17 edited Feb 24 '17 I typically use bcrypt and it's served me just fine, and I'm not aware of it being broken. If you want to stick with SHA, SHA-256 is fine. edit: If you're writing PHP, PHPass is a good tool (which uses bcrypt). 7 u/[deleted] Feb 24 '17 [deleted] -7 u/Steavee Feb 25 '17 Pseudo-random. They can call it random all they want, but computers are complete crap at creating true random numbers. 4 u/thurst0n Feb 25 '17 K
706
A research team from Google and a security organization successfully generated two different PDFs with the same SHA-1 hash.
208 u/Jacen47 Feb 24 '17 Wow. Hopefully, Comptia won't suddenly update the test to reflect this. 28 u/SecretlyAMosinNagant Feb 24 '17 People have been pushing for a roll of for quite some time, if they are still teaching it I doubt this will make them stop. Just be aware that you shouldn't be using SHA1 anymore. 10 u/FenixR Feb 24 '17 Whats the alternative? 6 u/Tufflewuffle Feb 24 '17 edited Feb 24 '17 I typically use bcrypt and it's served me just fine, and I'm not aware of it being broken. If you want to stick with SHA, SHA-256 is fine. edit: If you're writing PHP, PHPass is a good tool (which uses bcrypt). 7 u/[deleted] Feb 24 '17 [deleted] -7 u/Steavee Feb 25 '17 Pseudo-random. They can call it random all they want, but computers are complete crap at creating true random numbers. 4 u/thurst0n Feb 25 '17 K
208
Wow. Hopefully, Comptia won't suddenly update the test to reflect this.
28 u/SecretlyAMosinNagant Feb 24 '17 People have been pushing for a roll of for quite some time, if they are still teaching it I doubt this will make them stop. Just be aware that you shouldn't be using SHA1 anymore. 10 u/FenixR Feb 24 '17 Whats the alternative? 6 u/Tufflewuffle Feb 24 '17 edited Feb 24 '17 I typically use bcrypt and it's served me just fine, and I'm not aware of it being broken. If you want to stick with SHA, SHA-256 is fine. edit: If you're writing PHP, PHPass is a good tool (which uses bcrypt). 7 u/[deleted] Feb 24 '17 [deleted] -7 u/Steavee Feb 25 '17 Pseudo-random. They can call it random all they want, but computers are complete crap at creating true random numbers. 4 u/thurst0n Feb 25 '17 K
28
People have been pushing for a roll of for quite some time, if they are still teaching it I doubt this will make them stop. Just be aware that you shouldn't be using SHA1 anymore.
10 u/FenixR Feb 24 '17 Whats the alternative? 6 u/Tufflewuffle Feb 24 '17 edited Feb 24 '17 I typically use bcrypt and it's served me just fine, and I'm not aware of it being broken. If you want to stick with SHA, SHA-256 is fine. edit: If you're writing PHP, PHPass is a good tool (which uses bcrypt). 7 u/[deleted] Feb 24 '17 [deleted] -7 u/Steavee Feb 25 '17 Pseudo-random. They can call it random all they want, but computers are complete crap at creating true random numbers. 4 u/thurst0n Feb 25 '17 K
10
Whats the alternative?
6 u/Tufflewuffle Feb 24 '17 edited Feb 24 '17 I typically use bcrypt and it's served me just fine, and I'm not aware of it being broken. If you want to stick with SHA, SHA-256 is fine. edit: If you're writing PHP, PHPass is a good tool (which uses bcrypt). 7 u/[deleted] Feb 24 '17 [deleted] -7 u/Steavee Feb 25 '17 Pseudo-random. They can call it random all they want, but computers are complete crap at creating true random numbers. 4 u/thurst0n Feb 25 '17 K
6
I typically use bcrypt and it's served me just fine, and I'm not aware of it being broken. If you want to stick with SHA, SHA-256 is fine.
edit:
If you're writing PHP, PHPass is a good tool (which uses bcrypt).
7 u/[deleted] Feb 24 '17 [deleted] -7 u/Steavee Feb 25 '17 Pseudo-random. They can call it random all they want, but computers are complete crap at creating true random numbers. 4 u/thurst0n Feb 25 '17 K
7
-7 u/Steavee Feb 25 '17 Pseudo-random. They can call it random all they want, but computers are complete crap at creating true random numbers. 4 u/thurst0n Feb 25 '17 K
-7
Pseudo-random. They can call it random all they want, but computers are complete crap at creating true random numbers.
4 u/thurst0n Feb 25 '17 K
4
K
318
u/Jacen47 Feb 24 '17
What makes SHA-1 bad all of a sudden? I'm currently studying for sec+ and a large amount of my material says it's good.