13

Somebody has altered the tag wiki of to a completely new definition that does not cover most of the existing questions with the tag. The new 'meaning' isn't significantly different from what is generally associated with 'mere' .

I believe the change should be rolled back or corrected.

EDIT To address some of the comments:

  • @Braiam The tag is needed to adequately capture the existing questions about it and a most important security issue.
  • @Will The majority of the questions are about how or whether to encrypt a password, and 'hash' is exactly what the tag used to say before it was (IMO) vandalized.

Based on the upvotes and comments I'm going to restore it to its prior state.

7
  • 8
    The older version is also lacking usage guidance, not a great tag-wiki IMHO. You can only roll-forward, so provide a new tag-wiki that explains for which type of questions the tag should be used, when not to use, things to include in the questions, etc. Maybe add some great questions and canonical duplicate targets
    – rene
    Commented Apr 28, 2016 at 7:38
  • 4
    Sorry to break this down to you but... is this tag really needed?
    – Braiam
    Commented Apr 28, 2016 at 16:17
  • 11
    Are the majority of questions with that tag asking about how to encrypt a password, or how to secure them properly? If the latter, than the tag is being used improperly. And if not, then the tag is an X/Y honeypot, and the description should say "Don't encrypt--HASH!"
    – user1228
    Commented Apr 28, 2016 at 16:18
  • 2
    But I like introducing security vulnerabilities on a regular basis, @will. Commented Apr 29, 2016 at 1:30
  • 2
    @Will If you are developing a password manager you must encrypt password and not hash them. So What you are saying isn't strictly true. It's only true when you want to directly use the password for authentication, but there are other situations where passwords are handled.
    – Bakuriu
    Commented Apr 29, 2016 at 14:10
  • Why? How cares what the "task" is about, that's what titles are for. What tags are meant is for the components you are using (or plan to use) to complete the task given in the title.
    – Braiam
    Commented Apr 29, 2016 at 14:25
  • @Bakuriu thanks for pointing out the one instance among twenty billion where this is true. You're a god among men. I suggest you leave us now and put that excellent intellect to use for the benefit of mankind. Perhaps you should work on world peace? Good luck, and godspeed, and good day to you, sir!
    – user1228
    Commented Apr 29, 2016 at 14:54

3 Answers 3

3
  1. The edited wiki, despite the first couple words, isn't limited to password-based encryption, and is certainly different from "mere encryption". In particular it covers the correct ways of storing passwords safely in databases for authentication (bcrypt, scrypt, PBKDF2, and the majority of good password hashes are all KDFs, as described in the excerpt).

  2. We don't seem to have a tag for password hashing, and the advice "if your intent is to use passwords for authentication (e.g. for logins), you should look at hashing instead of encryption" is likely to lead people to use general-purpose hashes instead of password hashes, which is terrible. At the very least it needs specific advice to use suitable password hashes.

  3. Looking through the tagged questions myself, only a minority are about "encrypting a password with a password" — the majority are about hashed passwords, and the remainder are divided about equally between people who want password-based encryption, people who want to somehow store credentials safely in config files, and people who just have no clue what they want.

  4. Referring to password hashing as "encryption" is wrong, but it's a popular way to be wrong (as evidenced by the previous point). Word usage is tricky. Perhaps we need clearer disambiguation among all of the possibilities.

erickson's revision, with some minor tweaking to touch more directly on authentication uses, would cover more of the existing questions and be generally more useful than the "restored" revision, which seems oddly narrow and fundamentally useless to most people.

1
1

Yes, this is a big semantical change and should not have been done. PBE is completely different from encrypting the passwords themselves.

I've always retagged questions (removed and added) according to the excerpt pre-2016. As Will points out, if you find that tag and read the tag excerpt, then you should not ask the question you were about to ask. It's a trap.

The excerpt itself is pretty clear and I can even live completely without tag wiki. Also, I don't remember ever using this tag to find a duplicate or something like that, so I can also live happily without that tag. Simply synonymizing it to would be fine.

0

It looks to me like the old tag wiki was intended to be about password-manager use-cases.

[old entry] Password encryption is the act of securing a password with another password.

Does that need its own tag?

I disagree with the claim in this question that the tag says to "encrypt by hashing". It actually says/said (in the next sentence) that hashing is what you should do instead of encrypting, if that's what you came looking for, and that the tag isn't about that.

If the questions using the tag were about how to make auth tokens from passwords, or implement password authentication, then the questions were mis-tagged according to my reading of the text introduce by Rev4 (Jan 2013), live until Rev6 (Feb 2016). Perhaps a password-authentication tag is needed, or those questions should have use tagged with or . The seems to be about implementing systems that use passwords for authentication, and recommends hashing.


It also had a link to an article about why encrypting a password doesn't create a good auth token without pointing out that this was a different usage of the phrase.

If that was the intended use of the tag, then I think it needed to change. security.SE might want tags for specific security errors, even uncommon ones that, but I don't think SO needs a tag for every bad practice. There are too many pitfalls in software design to label every one with a tag.


Whatever the password-encryption tag is repurposed to, it should have a sentence to point people in the right direction if they wind up reading that tag wiki when they actually need password hashing.

3
  • 2
    There is no claim in this question that 'the tag says to "encrypt by hashing"'. There is no such thing. You have fabricated this nonsensical quotation and attributed it to me.
    – user207421
    Commented Apr 29, 2016 at 3:12
  • 3
    @EJP: I was talking about "The majority of the questions are about how or whether to encrypt a password, and 'hash' is exactly what the tag used to say". If that's not what you meant when you wrote that, then I'll rethink my answer. Does my last paragraph address what you meant? That whatever the tag thinks it's about, it should tell people to hash passwords in case they don't know that? Commented Apr 29, 2016 at 3:14
  • Peter, you have text up there, in quotation marks, that does not appear in my question. Trying to guess or paraphrase what you think I may have really meant is one thing: fabrication of quotations is quite another. It is not acceptable. It is blatant misrepresentation, and not acceptable in any circles. Kindly remove it.
    – user207421
    Commented Jul 1, 2016 at 7:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .