I'm helping my friend with hashing his passwords, and I've a question - Should he use one secret string as salt for hashing or is it better to have each user its own salt for hashing?
Consider these three hashes:
hash("secretKey777" + password); hash("secretKey777" + username + password); hash(username + password);
Which one is the hardest to crack and the safest?
I think it's best to use
hash("secretKey777" + username + password); because for each user not only has "secretKey777" as a salt but also its own username. In case code that hashes the passwords leaks, there will be no attack on all the hashes at once - each has will have its own unique salt.