Linked Questions
54 questions linked to/from Password Hashing: add salt + pepper or is salt enough?
21
votes
1
answer
3k
views
Password hashing : Using 2 salts [duplicate]
I'm developing an authentication service.
I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks.
I just had the idea ...
- 378
5
votes
1
answer
7k
views
Global salt vs salt-per-password [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
Any risk in using the same salt for several hashes on a user?
It's known that all password hashes need to be salted, ...
- 1,468
5
votes
1
answer
6k
views
I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
How to store salt?
Ok I have been studying a lot about password hashing lately. And I have a few questions. So I will ...
- 159
4
votes
1
answer
1k
views
Is it a good idea to use two salts? [duplicate]
Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course.
So for example, if you're using Golang as ...
- 59
5
votes
2
answers
1k
views
Hashed passwords storage: iterations vs entropy [duplicate]
Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them.
The DB holds user's accounts passwords. All connections ...
- 53
6
votes
2
answers
1k
views
PKCS#5 Salt privacy? [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
In the official documentation of the PKCS5 V2.0 standard, we can read "The salt can be viewed as an index into a large ...
- 241
2
votes
1
answer
762
views
php's password_hash with system wide salt [duplicate]
I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts ...
- 123
2
votes
3
answers
716
views
Password Security: Encrypting salt [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
I'm new to security and trying to understand why encrypting or hiding a salt is not considered useful. I've read the ...
- 121
944
votes
11
answers
330k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.5k
629
votes
7
answers
243k
views
How to store salt?
If you expect to store user password securely, you need to do at least the following:
$pwd=hash(hash($password) + salt)
Then, you store $pwd in your system instead of the real password. I have seen ...
- 6,477
671
votes
4
answers
335k
views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
- 6,795
95
votes
10
answers
18k
views
Does anybody not store salts?
We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
- 1,069
65
votes
7
answers
20k
views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
- 761
79
votes
4
answers
18k
views
Why add username to salt before hashing a password?
I have seen examples of password hashing that were: H(username + salt + password). What is the purpose of adding username? Is there any purpose?
- 790
43
votes
9
answers
19k
views
Is salting a hash really as secure as common knowledge implies?
I'm implementing a salt function for user passwords on my web page, and I'm wondering about some things.
A salt is an extension added to a password and then hashed, meaning the password is stored in ...
