Skip to main content
Share Your Experience: Take the 2024 Developer Survey

New answers tagged

0 votes

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

In order to make an encryption key out of a password you'll need a slow key derivation function made for passwords, such as scrypt, bcrypt, argon2, etc. root_key = slow_kdf(password, salt_1) Then you ...
n-l-i's user avatar
  • 326
-2 votes

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

The primary point of using a salt is to make sure that your passwords don’t match other people’s passwords. Many people use 123456 as a password. Without salt, they all have the same hash. Lots of ...
gnasher729's user avatar
  • 2,394
0 votes
Accepted

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

It means that if the communications is logged or intercepted the salt can be intercepted, any other user could look to see the method and since it is client side you might presume the hash method ...
Willtech's user avatar
  • 124
0 votes

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

So my idea was to derive the salt from the email using a KDF. In theory, this makes it possible for attackers to precompute the salt, and precompute many hashes, and use those to quickly brute-force ...
Sjoerd's user avatar
  • 30.8k
0 votes

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

Since your users send unencrypted data to the server, server sees unencrypted data before encrypting them and storing. Thus, "If a malicious actor ... wanted to access the customer data", ...
mentallurg's user avatar
  • 12.4k

Top 50 recent answers are included