Your Hash Needs More Salt mug

Product Page

For those who get it, great, they'll understand what your mug means, and for those who don't well hopefully it'll keep them away from your coffee mug.

I didn't see anything when I slipped and fell into the database

from here and here

A quick check of Have I Been Pwned indicates that yes, SHA1 is still being used. 

I didn't think it would be worth it to look for MD5 at first, I was so sure the age of MD5 was over and I would have had to look for a while to find an example, but nope, there was a breach using MD5 added at the beginning of this year. I didn't have to look far at all.

Crack Hashes Not Skulls shirt

Product Page

It feels weird posting a link to a product on Ebay. I'm not sure how long that's going to be around. I'm going to be honest, though - if someone is launching attacks I'd much rather be cracking skulls. Perhaps that's just me.

Making a hash of it by not making a hash of it

from here and here

All the comments I've seen about this so far have assumed this was about end users, which is fair because most people are end users so of course they would see if from that perspective. In reality, though, this is about system designers/architects. You know, the people who make sites and are supposed to hash your password rather than storing the plain text (or reversibly encrypted) version of it? Yeah, if that site says your password is too long it means they aren't hashing the passwords and so are doing it wrong.

A message to web developers

from here and here (image source one and two)

Plain text passwords have been way, way too common on websites over the years. No doubt the thing that made it so common is that login pages are so boring and easy to underestimate that developers don't spend the time to learn how to do them properly. That really hasn't changed which is why plain text passwords are still too common (as Plain Text Offenders handily demonstrates).