Study. uk . com
  1. Home
  2. All questions
  3. Question 460

CompTIA Security+ study material · question 460 of 611

Why is SHA-256 unsuitable for storing passwords even when salted?

  1. It produces collisions too readily
  2. It is not FIPS approved
  3. It is fast, so an attacker can test enormous numbers of guesses
  4. It cannot accept a salt
Show the answer

Answer: C. It is fast, so an attacker can test enormous numbers of guesses

Password storage needs a deliberately slow, memory-hard function with a tunable cost factor.

Source: OWASP Password Storage Cheat Sheet (OWASP) — OWASP Password Storage Cheat Sheet › Introduction

Challenge yourself on this topic → Study as cards