Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A04: Cryptographic Failures (2) — Password Storage, Data Protection and Secret Management
How exactly does ASP.NET Core Identity's PasswordHasher store a password? We decode the hash header to see PBKDF2-HMAC-SHA512 with 100,000 iterations, move to OWASP's 220,000 with SuccessRehashNeeded, build a signed, time-limited share link with the Data Protection API, and keep secrets out of the code with user-secrets and environment variables.
OWASP A04: Cryptographic Failures (1) — Encoding, Hashing, Encryption and HTTPS
Why Base64 is not encryption and how hashing differs from encryption. We catch tampered data with AES-GCM, use RandomNumberGenerator instead of Random for password reset codes, see why MD5 is wrong for passwords, turn on the CA5351 and CA5394 analyzers, and inspect HTTPS redirection and HSTS defaults in ASP.NET Core with curl.