Linked Questions

9
votes
5answers
2k views

Should I remotely store my salt? [duplicate]

When users register on my site, I want to store their username and hashed password in my database. When I hash that password, I'm going to salt it using PHP. The issue is, I don't want to store the ...
10
votes
1answer
3k views

Why store a salt along side the hashed password? [duplicate]

Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts. What I would like to understand is why you would store the salt along side the ...
5
votes
5answers
2k views

How secure is it to keep the salt with the password hash? [duplicate]

In Linux we have the salt just next to the password hash in the /etc/shadows file. I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
5
votes
1answer
5k views

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I will ...
2
votes
2answers
2k views

Is it secure to store the salt along with the hashed password in the database? [duplicate]

After reading some posts and articles about how to store user credentials in a database, in which all said that we should use a different salt for each user and save the salt in the database along ...
2
votes
2answers
614 views

Why does saving a salt as plain text still improve security? [duplicate]

I mean, for example you use salting to protect your password against a dictionary attack. But when I know that the salt from User X is jd38d83h8fh08h (because it is saved as plain text together with ...
0
votes
2answers
240 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
3answers
110 views

Are Salt strings stored by application? [duplicate]

1) As storing passwords in plain text in databases are not secure and so is not a good practice. password stored in db = "abcde" (plain text) 2) To avoid this, passwords are stored after being hashed ...
0
votes
0answers
23 views

Password Hashing - Where does the Salt gets stored [duplicate]

I have read that it is a best practice to store Hashed passwords using Hashing algorithms which uses Salt to protect from Rainbow table attack. My question is- if i store the hashed password in my ...
831
votes
13answers
233k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
525
votes
11answers
80k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
226
votes
7answers
83k views

Password Hashing: add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
102
votes
5answers
61k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
61
votes
7answers
13k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
39
votes
8answers
16k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...

15 30 50 per page