Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Sunday, November 6, 2016

Easy password hash migration from MD5 to BCrypt.

Many legacy production systems still use non-salted MD5 function for password hashing. These hashes are usually stored in the database and used for user authentication. The problem is that non-salted MD5 hash is no more secure today. There are so-called rainbow tables (precomputed MD5 hashes for word dictionaries) that can be used for easy reverse lookup.

Tuesday, February 21, 2012

Log4j filter to mask Payment Card numbers (PCI DSS)

According to PCI DSS (Payment Card Industry Data Security Standard) your application must not store payment card numbers. This requirement includes database, files and logs. The following filter will allow you to mask card numbers in your logs on the fly, so even if you accidentally turned debug mode on for network communication, you can be confident that your data is PCI compliant.