2

I just started a new job last week and I'm asking for a sanity-check before I mention this to anyone. All the new employee accounts are created with the same default password (I know, already a no-no). Today while running SQL queries I noticed that all the recently-created accounts had the exact same hashed value in the database. From my limited understanding, this indicates that the passwords are not being salted when hashed, which would be a major security issue. Am I right?

Improve this question

1 Answer 1

Reset to default
5

If all the passwords are the same, then identical hashes means that either:

  1. No salt is used, or
  2. The salt is always the same.

Either option defeats the purpose of salting hashes.

Improve this answer
4
  • 5
    It's also possible that new accounts are created using fixed salt+hash values (e.g. from a template user record), but that a new (unique/random) salt will be chosen when the user changes their password. This isn't really optimal, but wouldn't be a major problem either. To test, you could "change" your password to the exact same thing it was before, and see if the hash changes.
    – Gordon Davisson
    Apr 20, 2022 at 23:16
  • @GordonDavisson that's a great idea, I'm going to try that
    – the_midnight_developer
    Apr 21, 2022 at 1:50
  • 1
    @GordonDavisson I changed my password to something else, then changed it back to the default and it was back to the same hash as all the others...
    – the_midnight_developer
    Apr 21, 2022 at 13:10
  • 2
    @the_midnight_developer Then either no salt, or constant salt, just as Mark said. Either way, not good.
    – Gordon Davisson
    Apr 21, 2022 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .