I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts are even deprecated (from manual page).
The salt option has been deprecated as of PHP 7.0.0. It is now preferred to simply use the salt that is generated by default.
Anyway, I still feel like I should add own system wide salt like this:
$system_salt = 'system_secret_key'; $hash = password_hash($password.$system_salt, PASSWORD_BCRYPT);
So, if anyone would gain an access to the database, but not the scripts, even after cracking the password, he would only find salted password (or collision) that would not be usable on other sites.
- Is this a good approach?
- Can this make hashes less secure (easier to crack) as they all will have same sequence of characters (system wide salt) at the end?