1,622 reputation
1713
bio website martinstoeckli.ch
location Switzerland
age 42
visits member for 3 years, 1 month
seen 2 hours ago

I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working now mostly with CSharp and use PHP for my spare time project, an internet lost-and-found office.


Sep
1
comment Do salts have to be random, or just unique and unknown?
@Griffin - I think the OP's question actually is: "Can storing a salt be avoided completely, derriving the salt from userid, constant text, and the password itself".
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy - You cannot rehash the password when updating the email address. To create the new password-hash you need the email and the original password, but at this moment you know only the email and the hash of the original password.
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy - Ok i understand now, you don't want to store the salt at all, and therefore want to derrive the salt completely from other parameters. There is one problem though, it will make it impossible to change the parameters afterwards. When the user wants to update the email and you used it as salt, you cannot recalculate the password-hash with the new email, because you do not know the original password then. You would have to store the old email as well, what makes it no better than storing a salt.
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy - You already answered it well. The hash is used to make it impossible to retrieve the original password, so storing the password as salt in a retrievable form will undo the whole effort (you need it for verification). If you want to add a server side secret, a good method is, to encrypt the password-hash with a server side key, or to use a pepper. But don't mix up the two, let the salt be known (plaintext) and the server-side key be a secret.
Sep
1
comment Do salts have to be random, or just unique and unknown?
Calling a hash like sha-256 will not generate any entrophy at all. The number of possible inputs will fix the number of possible hash-values.
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy - To double the password would help nothing at all, this would be just another hash algorithm. It would not even add a server side secret (the algorithm), since the salt is normally stored plaintext. You could then build 1 rainbowtable to recover all passwords of your database.
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy - It doesn't matter, whether a user has the same id on another site, a rainbow-table with those salts would contain "all" passwords with all of the choosen salts, thus working for every site. About the email, you cannot presume that the emails are hidden from the public, hashes are made or the case, when the database is already stolen, so the email addresses will be known as well. Using the email as salt, maybe combined with other data and hashed, is not the worst thing you can do, but using a random independend salt is always better.
Sep
1
comment Do salts have to be random, or just unique and unknown?
@IlmariKaronen - Just wrote a bit more clear what i meant (about the middle part), probably you didn't notice the edit. And of course key-stretching is a must today.
Sep
1
revised Do salts have to be random, or just unique and unknown?
deleted 107 characters in body
Sep
1
revised Do salts have to be random, or just unique and unknown?
added 5 characters in body
Sep
1
revised Do salts have to be random, or just unique and unknown?
Justification about salt thwarting brute-force attacks.
Sep
1
revised Do salts have to be random, or just unique and unknown?
added 96 characters in body
Sep
1
answered Do salts have to be random, or just unique and unknown?
Aug
29
revised Why is password hashing considered so important?
Thanks TRiG for your corrections (english isn't my native language), but this point is necessary.
Aug
29
awarded  Custodian
Aug
29
reviewed Approve Why is password hashing considered so important?
Aug
29
answered Why is password hashing considered so important?
Aug
27
answered Please help verify my understanding of Domain Validation (DV) SSL Certificate
Aug
23
comment 419 Nigerian scam problem
@eternalidiot - Macs are handling the file type separately as far as i know. If opening this pictures is the only thing you did, i wouldn't worry too much about your computer. Opening pictures is what a browser does all the time.
Aug
23
comment 419 Nigerian scam problem
@eternalidiot - So then you could check, whether they are real pictures you opened. On Windows systems, the file extension is important, normal pictures have an ending like filename.jpg or filename.png. Executeables have an ending like filename.exe but can try to hide this with filename.jpg.exe, because Windows will hide the last part. I don't know how experienced you are, but this is a check i would do, it is very unlikely that real pictures are harmful.