Linked Questions
71 questions linked to/from How to store salt?
9
votes
5
answers
2k
views
Should I remotely store my salt? [duplicate]
When users register on my site, I want to store their username and hashed password in my database. When I hash that password, I'm going to salt it using PHP.
The issue is, I don't want to store the ...
- 214
14
votes
1
answer
8k
views
Why store a salt along side the hashed password? [duplicate]
Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts.
What I would like to understand is why you would store the salt along side the ...
- 394
5
votes
5
answers
4k
views
How secure is it to keep the salt with the password hash? [duplicate]
In Linux we have the salt just next to the password hash in the /etc/shadows file.
I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
- 393
3
votes
2
answers
3k
views
Is it secure to store the salt along with the hashed password in the database? [duplicate]
After reading some posts and articles about how to store user credentials in a database, in which all said that we should use a different salt for each user and save the salt in the database along ...
- 41
3
votes
2
answers
2k
views
Why does saving a salt as plain text still improve security? [duplicate]
I mean, for example you use salting to protect your password against a dictionary attack. But when I know that the salt from User X is jd38d83h8fh08h (because it is saved as plain text together with ...
5
votes
1
answer
6k
views
I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
How to store salt?
Ok I have been studying a lot about password hashing lately. And I have a few questions. So I will ...
- 159
2
votes
3
answers
288
views
Are Salt strings stored by application? [duplicate]
1) As storing passwords in plain text in databases are not secure and so is not a good practice.
password stored in db = "abcde" (plain text)
2) To avoid this, passwords are stored after being hashed ...
- 151
0
votes
2
answers
335
views
How do you overcome the problem of the salt being public and known by the attacker? [duplicate]
I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt?
How is it possible to add value ...
- 3,488
1
vote
1
answer
239
views
Password hashing with salt. Where do you leave the salt? [duplicate]
I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that:
The salt should be random.
The salt should not be reused.
Using hashing without salt makes ...
- 113
0
votes
0
answers
150
views
Why people buy stolen databases with emails and hashed passwords of users? [duplicate]
I see every now and then how hackers stole DB with emails and hashed passwords of millions of users from popular websites and sell it on the black market.
I assume that passwords were hashed with ...
- 101
0
votes
0
answers
64
views
Is salt even secure once hacker has access to the database? [duplicate]
I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
- 9
0
votes
1
answer
71
views
Question about storing salt values and hashed passwords in the database [duplicate]
So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
- 101
1
vote
0
answers
35
views
How should an argon2 hash be stored? [duplicate]
Given the following argon2 hash
$argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8
How should the hash be stored in a database? From the answers of ...
- 11
944
votes
11
answers
332k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.6k
546
votes
11
answers
95k
views
Is my developer's home-brew password security right or wrong, and why?
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below.
His team spent months adopting an industry standard protocol using Bcrypt. ...
- 4,739