Timeline for What should be used as a salt?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 8, 2018 at 13:10 | comment | added | Fax | Isn't the salt in "a different random salt for different users" worse than pepper + username? Did you mean a different random salt for each password change? | |
| Jun 15, 2017 at 8:14 | comment | added | AndrewD | Just been reading crackstation.net/hashing-security.htm, which discusses this in more depth | |
| Sep 24, 2016 at 16:51 | comment | added | Xiong Chiamiov | The purpose of a salt is to provide a value that breaks rainbow tables, and they perform that job whether or not an attacker has access to them. If you're looking to protect further, you may wish to consider adding pepper. | |
| Oct 10, 2014 at 22:33 | comment | added | bodacydo |
Is it safe to store the salt together with username and password hash? If database gets hacked, anyone can see what the salt was and therefore use it to crack the password. wouldn't it be more secure not to include the salt, but rather use something like 'md5(username+"HDJ897#3%"+password)'? In this case there is no way someone can guess that the salt was totally unique value username+"HDJ897#3%".
|
|
| Oct 12, 2011 at 6:40 | history | answered | Robert David Graham | CC BY-SA 3.0 |