Linked Questions

21 votes
1 answer
3k views

Password hashing : Using 2 salts [duplicate]

I'm developing an authentication service. I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks. I just had the idea ...
user avatar
  • 378
5 votes
1 answer
6k views

Global salt vs salt-per-password [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? Any risk in using the same salt for several hashes on a user? It's known that all password hashes need to be salted, ...
user avatar
  • 1,478
5 votes
1 answer
5k views

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I will ...
user avatar
  • 159
4 votes
1 answer
1k views

Is it a good idea to use two salts? [duplicate]

Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course. So for example, if you're using Golang as ...
user avatar
5 votes
2 answers
865 views

Hashed passwords storage: iterations vs entropy [duplicate]

Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them. The DB holds user's accounts passwords. All connections ...
user avatar
  • 53
7 votes
2 answers
1k views

PKCS#5 Salt privacy? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? In the official documentation of the PKCS5 V2.0 standard, we can read "The salt can be viewed as an index into a large ...
user avatar
2 votes
1 answer
695 views

php's password_hash with system wide salt [duplicate]

I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts ...
user avatar
  • 123
2 votes
3 answers
684 views

Password Security: Encrypting salt [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? I'm new to security and trying to understand why encrypting or hiding a salt is not considered useful. I've read the ...
user avatar
918 votes
11 answers
299k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
user avatar
  • 71.8k
592 votes
7 answers
202k views

How to store salt?

If you expect to store user password securely, you need to do at least the following: $pwd=hash(hash($password) + salt) Then, you store $pwd in your system instead of the real password. I have seen ...
user avatar
  • 6,107
652 votes
4 answers
308k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
user avatar
  • 6,605
92 votes
9 answers
17k views

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
user avatar
  • 1,039
66 votes
7 answers
17k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
user avatar
81 votes
4 answers
17k views

Why add username to salt before hashing a password?

I have seen examples of password hashing that were: H(username + salt + password). What is the purpose of adding username? Is there any purpose?
user avatar
43 votes
9 answers
18k views

Is salting a hash really as secure as common knowledge implies?

I'm implementing a salt function for user passwords on my web page, and I'm wondering about some things. A salt is an extension added to a password and then hashed, meaning the password is stored in ...
user avatar

15 30 50 per page