{"id":22176,"date":"2017-03-10T10:00:33","date_gmt":"2017-03-10T15:00:33","guid":{"rendered":"https:\/\/simpleprogrammer.com\/?p=22176"},"modified":"2023-02-14T08:38:56","modified_gmt":"2023-02-14T13:38:56","slug":"protect-your-passwords","status":"publish","type":"post","link":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/","title":{"rendered":"Protect Your Passwords"},"content":{"rendered":"<p>Recently, I created an account with a site (which shall remain nameless). Everything seemed cool at first. Then I submitted my application and was instantly greeted with a message: \u201cThanks for signing up. Your username is XXXX and your password is XXXX\u201d. Yes, the site showed my password in cleartext right on the screen.\\n\\nThat is pretty bad, right? Well, then something worse happened: I received an email. Can you guess what was in the email? That\u2019s right: \u201cThanks for signing up. Your username is XXXX and your password is XXXX\u201d. The password was sent to me in an email, again in cleartext.\\n\\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22178\" src=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/facepalm.png\" alt=\"passwords\" width=\"420\" height=\"285\" \/>\\n\\nI agree, Captain Picard.\\n\\nIf this story doesn\u2019t make you facepalm, it should. Now, let\u2019s talk about why careless password security is <em>really <\/em>bad, what policies and procedures you should have when storing passwords, and <a href=\"https:\/\/simpleprogrammer.com\/better-software-engineer-tips\/\">tips for a serious programmer<\/a>\u00a0to protect his passwords properly.\\n\\n<\/p>\n<h2>How Not to Protect Your Passwords<\/h2>\n<p>\\n\\n<strong>Storing passwords in cleartext.<\/strong> The number one practice that is completely wrong and indefensible is storing passwords in cleartext, as illustrated in the above example. This means whatever the user enters as their password will be directly stored in the database without any scrambling to prevent someone from seeing what they are. If you enter \u201cp@ssw0rd!\u201d as your password, then \u201cp@ssw0rd!\u201d is what is stored in the database. If someone gets into your database, they will be able to steal anyone\u2019s credentials and impersonate them. Here\u2019s a hint: if a website can send you your password, that means it is storing them in cleartext.\\n\\n<strong>Allow any humans to see passwords.<\/strong> Here is a quiz question: who should be allowed to see users\u2019 passwords? The answer: NO ONE. Don\u2019t fool yourself into thinking that system administrators or help desk personnel need to see passwords in order to do their jobs. This is a very bad practice that leaves you open to social engineering attacks.\\n\\n<strong>Encrypting passwords instead of hashing them<\/strong>. While there are times that an application may need to encrypt passwords, this should never be done with a user account\u2019s password. The main reason for this is that if something is encrypted, it can be decrypted. You want to use hashes, or one-way functions that make it infeasible to get the input back out given the output. That brings us to our next point.\\n\\n<strong>Using weak hashing algorithms or techniques.<\/strong> Just because you hash a password doesn\u2019t mean it is safe. Which hashing algorithm did you use? Did you hash it only once and expect it to be okay? There are some subtleties to password hashing that can cause weaknesses and lead to compromise.\\n\\nDo not despair. Let\u2019s take a look at how developers can do it right.\\n\\n<\/p>\n<h2>How to Properly Protect Your Passwords<\/h2>\n<p>\\n\\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-22275\" src=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Password-1-1024x576.png\" alt=\"\" width=\"752\" height=\"423\" srcset=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Password-1-1024x576.png 1024w, https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Password-1-300x169.png 300w, https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Password-1-768x432.png 768w, https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Password-1.png 1280w\" sizes=\"auto, (max-width: 752px) 100vw, 752px\" \/>\\n\\nThe first step to figuring out how to properly protect your passwords is understanding what kind of attacks the bad guys will use to try to get or guess those passwords. In this vein, let\u2019s take a quick look at some of the top ways passwords are cracked today (a more complete list can be found <a href=\"http:\/\/www.infosecisland.com\/blogview\/18538-Top-Ten-Password-Cracking-Methods.html\">here<\/a>).\\n\\n<\/p>\n<ul>\\n    <\/p>\n<li>Dictionary attack \u2013 This attack is, as it sounds, when a dictionary of words is used to try to guess a user\u2019s password.<\/li>\n<p>\\n<\/ul>\n<p>\\n\\n<\/p>\n<ul>\\n    <\/p>\n<li>Brute force attack \u2013 This is just a computer guessing every possible combination of alphanumeric characters until it finds the right password.<\/li>\n<p>\\n<\/ul>\n<p>\\n\\n<\/p>\n<ul>\\n    <\/p>\n<li>Rainbow table attack \u2013 A rainbow table is a table of precomputed hashes of passwords. If password hashes are stolen from a database (for example, from an SQL injection attack), the attacker can simply search for the stolen hashes in the table to figure out the correct password. These nasty things are why just hashing your password is not enough.<\/li>\n<p>\\n<\/ul>\n<p>\\n\\n<\/p>\n<ul>\\n    <\/p>\n<li>Offline cracking attack \u2013 Another side-effect of stolen hashes is that they are often published and made available. Once they are out, someone can just sit and use the above techniques until he\/she finds some good passwords to steal.<\/li>\n<p>\\n<\/ul>\n<p>\\n\\n<\/p>\n<ul>\\n    <\/p>\n<li>Collision-based attack \u2013 This is rarer and more difficult, but it is possible and thus you should be aware of it. A collision-based attack involves trying to find a set of characters that, when hashed, will produce the same output as your password. That way, the attacker does not have to have your actual password since, if the hashes match, the system will let you in. This is a big reason why you need to choose a good algorithm to ensure that the chances of collision are sufficiently low.<\/li>\n<p>\\n<\/ul>\n<p>\\n\\nThese attacks can be mitigated by two things: long, random passwords and secure cryptographic storage. It\u2019s up to your users to provide good passwords (and you can help with policies), but it\u2019s up to you to provide the secure storage.\\n\\nThe best way to provide that secure storage is by handling hashing correctly.\\n\\n<\/p>\n<h3>Strong hashes<\/h3>\n<p>\\n\\nThe first step in effective hashing is choosing the best hashing algorithm. This is the foundation of your password storage architecture and is arguably the most important decision. Some hash algorithms have been shown to be weak. MD5 is one such algorithm. It has been shown to produce collisions\u2014a big red flag when it comes to security. Another argument against it is the fact that it is a fast and memory-efficient hashing algorithm. To critique this may seem strange at first but consider this: the more efficient the algorithm, the faster you can make guesses. This means that MD5 is much easier to crack using brute force than other hashing algorithms.\\n\\nThe secure hash (SHA) family of hashes was developed by the NSA and published as the FIPS 180 series of standards published by NIST. This family consists of SHA-1, SHA-2, and SHA-3. SHA-1 has <a href=\"https:\/\/shattered.io\/\">recently been shown<\/a> to have collision problems and has been deprecated by NIST since 2011. SHA-3 is still very new and isn\u2019t in wide use yet. SHA-2 is your best bet for an algorithm that has withstood scrutiny and has shown itself to be unpredictable and collision-free. It comes in two flavors: SHA-256 and SHA-512, named after the amount of bits output by the algorithms.\\n\\n<\/p>\n<h3>Salted hashes<\/h3>\n<p>\\n\\nWe spoke earlier of rainbow table attacks. These are the reason that just hashing your passwords before storing them is not enough. Salted hashes are the prescribed way of defeating rainbow tables.\\n\\nA salt is a random value that is generated and added to the password provided by the user before hashing the value and storing the hash in the database. This bit of randomness ensures that an attacker would have to precompute all hashes for all possible combinations of salt and password value, which is quite difficult.\\n\\nSalts should be generated by using a cryptographically secure random number generator. This ensures that even if two users provide the same password, their hashes will be different. See how this works in the example below:\\n\\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22179\" src=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/salted_hash_example.png\" alt=\"passwords\" width=\"532\" height=\"208\" \/>\\n\\nThat bit of randomness added to the password will further protect all of your users in the case of a data breach.\\n\\n<\/p>\n<h3>Password-based key derivation functions<\/h3>\n<p>\\n\\nAnother great tool developers can use to protect their passwords is a password-based key derivation function, or PBKDF. PBKDFs are great tools for two reasons:\\n\\n<\/p>\n<ol>\\n    <\/p>\n<li>They make it practically impossible to figure out passwords using rainbow tables.<\/li>\n<p>\\n    <\/p>\n<li>They make it really hard to brute force passwords because they deliberately slow down the hash calculation.<\/li>\n<p>\\n<\/ol>\n<p>\\n\\nPBKDFs take three inputs: the password you want to hash, the salt, and a number of iterations to perform on the password to get the final hash.\\n\\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22185\" src=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Screen-Shot-2017-03-07-at-9.25.38-PM-2.png\" alt=\"\" width=\"1350\" height=\"676\" \/>\\n\\nA huge advantage of PBKDFs is that they are configurable by nature. As processors get faster and better at cracking passwords, you can simply increase the number of iterations in order to stay ahead of the bad guys.\\n\\nKeep in mind that there are tradeoffs associated with this method. Increasing the number of iterations will also increase processing time. This is a great defense against brute force attacks, but will mean longer processing times for users if you are using PBKDFs for the user authentication process.\\n\\nYou should find a balance between security and usability, as is often the case. I suggest 50,000 iterations as a baseline, increasing as you can tolerate the performance impact.\\n\\n<\/p>\n<h2>How to Use .NET to Protect Your Passwords<\/h2>\n<p>\\n\\nNow that you understand the high-level concepts that can be used with any technology, let\u2019s take a look at how .NET enables developers to protect passwords within their systems.\\n\\nIf you want good cryptography using the .NET framework, then you should get familiar with the System.Security.Cryptography namespace. Many of the tools we will discuss here are in that namespace. Let\u2019s begin.\\n\\n<\/p>\n<h3>RNGCryptoServiceProvider<\/h3>\n<p>\\n\\nThe first order of business when you are implementing cryptography is choosing the correct random number generator. Random number generators will be the source of entropy for your keys in encryption and salts for hashes. We\u2019ll concentrate on how to create a salt with a random number generator, but the same technique would work for creating a key as well.\\n\\nFor secure random numbers in .NET, use the RNGCryptoServiceProvider to generate a random set of bytes that you can then use as your salt. <strong>Do not use System.Random to generate secure random numbers.<\/strong> System.Random was not created with security in mind, and thus has a repeatable and guessable pattern in its generation of random numbers. RNGCryptoServiceProvider will give you the entropy you need for a secure salt (or key).\\n\\nYou use RNGCryptoServiceProvider by creating an instance and using the GetBytes method to generate the random set of bytes. RNGCryptoServiceProvider\u00a0implements IDisposable, so make\u00a0sure you\u00a0wrap it in a using statement to make sure\u00a0the object is\u00a0properly disposed of when you are done with it.\\n\\nBelow is an example of using the RNGCryptoServiceProvider to securely generate a salt:\\n\\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22182\" src=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/RNGCrypto.png\" alt=\"\" width=\"496\" height=\"198\" \/>\\n\\nIt\u2019s only a few lines of code, but it can make a world of difference in the strength of your encryption and hashes. Wrap up the RNGCryptoServiceProvider in\u00a0a library so that all of your developers can use it for all applications.\\n\\n<\/p>\n<h3>Hashing passwords with .NET<\/h3>\n<p>\\n\\nThe System.Security.Cryptography has many classes that implement common encryption and hashing algorithms. It would be wise to become familiar with them. The classes available to you are simply named after the algorithm you want to use. There is the MD5 class, the SHA1, SHA256, and SHA512 classes, and so on.\\n\\nSHA256 and SHA512 are your best bets for secure hashing (along with a random salt). Using them is actually refreshingly simple. You instantiate an object by calling the static Create() method on the class you want to use and then call ComputeHash() method to get the hash. It looks like this:\\n\\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22183\" src=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/SHA256.png\" alt=\"\" width=\"307\" height=\"73\" \/>\\n\\nIf you wish to use a PBKDF for storage of passwords, the .NET framework provides a class called rfc2898DeriveBytes (named after the <a href=\"https:\/\/www.ietf.org\/rfc\/rfc2898.txt\">RFC<\/a> of the specific PBKDF used). It\u2019s kind of a strange name, but the usage is still pretty simple:\\n\\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22184\" src=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/rfc2898.png\" alt=\"\" width=\"558\" height=\"73\" \/>\\n\\n<\/p>\n<h3>SecureString<\/h3>\n<p>\\n\\nAn often overlooked security feature available in .NET is the SecureString class in the System.Security namespace. The SecureString class provides a secure alternative to the base String class when dealing with sensitive data such as passwords or credit card numbers. Let\u2019s take a look at what the differences are between these two classes.\\n\\n<\/p>\n<table>\\n<\/p>\n<tbody>\\n<\/p>\n<tr>\\n<\/p>\n<td><strong>String<\/strong><\/td>\n<p>\\n<\/p>\n<td><strong>SecureString<\/strong><\/td>\n<p>\\n<\/tr>\n<p>\\n<\/p>\n<tr>\\n<\/p>\n<td>Multiple copies in memory<\/td>\n<p>\\n<\/p>\n<td>One copy in memory<\/td>\n<p>\\n<\/tr>\n<p>\\n<\/p>\n<tr>\\n<\/p>\n<td>In memory unencrypted<\/td>\n<p>\\n<\/p>\n<td>Encrypted in memory<\/td>\n<p>\\n<\/tr>\n<p>\\n<\/p>\n<tr>\\n<\/p>\n<td>No easy way to zero out<\/td>\n<p>\\n<\/p>\n<td>Implements IDisposable and a Clear() method<\/td>\n<p>\\n<\/tr>\n<p>\\n<\/p>\n<tr>\\n<\/p>\n<td>Immutable, so extra are created and kept in memory when changed<\/td>\n<p>\\n<\/p>\n<td>MakeReadOnly() method to prevent any changes to the string<\/td>\n<p>\\n<\/tr>\n<p>\\n<\/tbody>\n<p>\\n<\/table>\n<p>\\n\\n<span style=\"font-weight: 400;\">\\n<\/span>The SecureString should not be used everywhere, but its use should be considered when dealing with any sensitive data in memory.\\n\\n<\/p>\n<h3>CryptSharp<\/h3>\n<p>\\n\\nI stumbled upon an interesting library called <a href=\"https:\/\/www.zer7.com\/software\/cryptsharp\">CryptSharp<\/a>. It offers many great tools and cryptographic functions that could definitely come in handy if you don\u2019t want to roll your own tools such as salt generators. It also provides you with the ability to use any hash algorithm with a PBKDF, as the native .NET implementation only supports SHA-1. It\u2019s definitely worth a look if you are serious about securing your passwords.\\n\\n<\/p>\n<h3>ASP.NET Identity<\/h3>\n<p>\\n\\nThe last .NET framework piece I\u2019ll mention is ASP.NET Identity. This library is included in the project templates for ASP.NET applications in Visual Studio, and is meant to provide a clean interface for developers to manage identities without rolling their own identity management solutions.\\n\\nThe secure storage of passwords is abstracted away, which can be good or bad depending on your opinion of such things. The full scope of functionality could be a post unto itself. The best place to get started would be on the <a href=\"https:\/\/docs.microsoft.com\/en-us\/aspnet\/identity\/overview\/getting-started\/introduction-to-aspnet-identity\">official docs site<\/a>.\\n\\n<\/p>\n<h2>The Final Dos and Don\u2019ts of Password Storage<\/h2>\n<p>\\n\\nI know all this information is undoubtedly a lot to take in. But here are the things I want you to remember:\\n\\n<\/p>\n<ol>\\n    <\/p>\n<li><strong>Never<\/strong> store passwords in cleartext, anywhere.<\/li>\n<p>\\n    <\/p>\n<li>Just hashing is not enough, as rainbow tables can easily break through them.<\/li>\n<p>\\n    <\/p>\n<li>Salt your passwords with random data before hashing them to strengthen the hashes.<\/li>\n<p>\\n    <\/p>\n<li>The best protection against password attacks is to use a PBKDF, but remember that there is a performance cost.<\/li>\n<p>\\n    <\/p>\n<li>The System.Security.Cryptography namespace holds hash implementations\u00a0and a PBDKF implementation for your use.<\/li>\n<p>\\n    <\/p>\n<li>Don\u2019t use System.Random for random numbers. Instead, use RNGCryptoServiceProvider.<\/li>\n<p>\\n<\/ol>\n<p>\\n\\nThe thought of storing passwords doesn\u2019t have to be scary. Understanding best practices\u00a0is the first step. From there, you can use good judgement, always keeping your users\u2019 best interests at heart. Armed with both knowledge and empathy, you can keep your users safe and your passwords secure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently, I created an account with a site (which shall remain nameless). Everything seemed cool at first. Then I submitted my application and was instantly greeted with a message: \u201cThanks for signing up. Your username is XXXX and your password is XXXX\u201d. Yes, the site showed my password in cleartext right on the screen.\\n\\nThat is&#8230;<\/p>\n","protected":false},"author":1035,"featured_media":22276,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[162232877],"tags":[],"class_list":["post-22176","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-better-software-engineer"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Protect Your Passwords - Simple Programmer<\/title>\n<meta name=\"description\" content=\"Careless password security is really bad. But there are policies and procedures you can use when storing passwords to protect them properly.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/simpleprogrammer.com\/protect-your-passwords\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Protect Your Passwords - Simple Programmer\" \/>\n<meta property=\"og:description\" content=\"Careless password security is really bad. But there are policies and procedures you can use when storing passwords to protect them properly.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/simpleprogrammer.com\/protect-your-passwords\/\" \/>\n<meta property=\"og:site_name\" content=\"Simple Programmer\" \/>\n<meta property=\"article:published_time\" content=\"2017-03-10T15:00:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-02-14T13:38:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Your-Passwords.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Protect Your Passwords\",\"datePublished\":\"2017-03-10T15:00:33+00:00\",\"dateModified\":\"2023-02-14T13:38:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/\"},\"wordCount\":2403,\"commentCount\":6,\"image\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/simpleprogrammer.com\\\/wp-content\\\/uploads\\\/2017\\\/03\\\/Protect-Your-Passwords.png\",\"articleSection\":[\"Better Software Engineer\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/\",\"url\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/\",\"name\":\"Protect Your Passwords - Simple Programmer\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/simpleprogrammer.com\\\/wp-content\\\/uploads\\\/2017\\\/03\\\/Protect-Your-Passwords.png\",\"datePublished\":\"2017-03-10T15:00:33+00:00\",\"dateModified\":\"2023-02-14T13:38:56+00:00\",\"author\":{\"@id\":\"\"},\"description\":\"Careless password security is really bad. But there are policies and procedures you can use when storing passwords to protect them properly.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/#primaryimage\",\"url\":\"https:\\\/\\\/simpleprogrammer.com\\\/wp-content\\\/uploads\\\/2017\\\/03\\\/Protect-Your-Passwords.png\",\"contentUrl\":\"https:\\\/\\\/simpleprogrammer.com\\\/wp-content\\\/uploads\\\/2017\\\/03\\\/Protect-Your-Passwords.png\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/protect-your-passwords\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/simpleprogrammer.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Protect Your Passwords\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/#website\",\"url\":\"https:\\\/\\\/simpleprogrammer.com\\\/\",\"name\":\"Simple Programmer\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/simpleprogrammer.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"\",\"url\":\"https:\\\/\\\/simpleprogrammer.com\\\/author\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Protect Your Passwords - Simple Programmer","description":"Careless password security is really bad. But there are policies and procedures you can use when storing passwords to protect them properly.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/","og_locale":"en_US","og_type":"article","og_title":"Protect Your Passwords - Simple Programmer","og_description":"Careless password security is really bad. But there are policies and procedures you can use when storing passwords to protect them properly.","og_url":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/","og_site_name":"Simple Programmer","article_published_time":"2017-03-10T15:00:33+00:00","article_modified_time":"2023-02-14T13:38:56+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Your-Passwords.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Written by":"","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/#article","isPartOf":{"@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/"},"author":{"name":"","@id":""},"headline":"Protect Your Passwords","datePublished":"2017-03-10T15:00:33+00:00","dateModified":"2023-02-14T13:38:56+00:00","mainEntityOfPage":{"@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/"},"wordCount":2403,"commentCount":6,"image":{"@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/#primaryimage"},"thumbnailUrl":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Your-Passwords.png","articleSection":["Better Software Engineer"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/simpleprogrammer.com\/protect-your-passwords\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/","url":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/","name":"Protect Your Passwords - Simple Programmer","isPartOf":{"@id":"https:\/\/simpleprogrammer.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/#primaryimage"},"image":{"@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/#primaryimage"},"thumbnailUrl":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Your-Passwords.png","datePublished":"2017-03-10T15:00:33+00:00","dateModified":"2023-02-14T13:38:56+00:00","author":{"@id":""},"description":"Careless password security is really bad. But there are policies and procedures you can use when storing passwords to protect them properly.","breadcrumb":{"@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/simpleprogrammer.com\/protect-your-passwords\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/#primaryimage","url":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Your-Passwords.png","contentUrl":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2017\/03\/Protect-Your-Passwords.png","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/simpleprogrammer.com\/protect-your-passwords\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/simpleprogrammer.com\/"},{"@type":"ListItem","position":2,"name":"Protect Your Passwords"}]},{"@type":"WebSite","@id":"https:\/\/simpleprogrammer.com\/#website","url":"https:\/\/simpleprogrammer.com\/","name":"Simple Programmer","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/simpleprogrammer.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"","url":"https:\/\/simpleprogrammer.com\/author\/"}]}},"_links":{"self":[{"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/posts\/22176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/users\/1035"}],"replies":[{"embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/comments?post=22176"}],"version-history":[{"count":0,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/posts\/22176\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/media\/22276"}],"wp:attachment":[{"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/media?parent=22176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/categories?post=22176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/tags?post=22176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}