3

I currently have a website that will be going live soon. The passwords are hashed. Is that all I need to do to comply with General Data Protection Regulation's encryption article?

Please cite and refer to any specific article number that applies, where possible.

  • 5
    Everybody involved in computer security will tell you that a merely hashed password database is criminally insecure. Salted + hashed is the standard, and protecting your database is also required. If you don't do these things, expect to be sued if passwords are leaked, no matter what GDPR says. – gnasher729 Jun 11 '17 at 16:53
  • 2
    I'd recommend hiring someone who knows what they are doing in respect to security. – gnasher729 Jun 11 '17 at 16:54
5

As @gnasher729 has commented, "a merely hashed password database is criminally insecure. Salted + hashed is the standard, and protecting your database is also required."

GDPR Paragraph 78 says (inter alia)

In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default.

Hash without salt is hardly good design.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.