3 ms·

Also, it talks about salting, but it's NOT a salt, or at least it's a horrible salt. A true salt should not be reused at all, it should be unique to each passw

by Vendan 11y ago

Also, it talks about salting, but it's NOT a salt, or at least it's a horrible salt. A true salt should not be reused at all, it should be unique to each password hash. Generally you see something like '<storedhash> = salt + hash(salt + password)' so you can recover the salt automatically.

kyrra 11y ago
A global salt for all your stores passwords at least prevents generic rainbow tables from being used against a stolen password database. Salts per password prevents the same password from having the same hash result in your database.
- bschwindHN 11y ago
  There's really no reason to ever use a global salt, it's not like it's hard to generate a random one for each user. If you're already putting in the effort to use salts, might as well go all the way instead of saying "well it's better than nothing ¯\_(ツ)_/¯" (I'm not directing this at you in particular, just at anyone who intentionally takes half-measures when it comes to security)
  - z92 11y ago
    Theres always will exist an option of having more security, than whatever is already providing by any system. That brings up the question: when, choosing to not include more security, isn't considered a bug?
    - toolz 11y ago
      Not sure where the line is drawn, but it's definitely inclusive of the more secure option when it can be implemented in <10 LoCs of code simple enough 99% of the professional dev community can write it.
      - Vendan 11y ago
        Even worse, using an actual password hashing lib, i.e. golang.org/x/crypto/bcrypt, is usually going to take care of it for you. 2 lines of code, 1 to make the hash when the password changes, 1 to check if the password matches the hash, and you are done!(as the library already generates and includes random salts in the hash for you)
  - adrusi 11y ago
    Last pass used both: a global salt and a per-password salt. The idea was that the global salt isn't stored in the database so if the attacker doesn't have access to the application server, they cant find what that salt is at all.
darkr 11y ago
> A true salt should not be reused at all. I agree with the practice of salt non-reuse, but it's not a part of the definition of. A nonce on the other hand does mandate non-reuse.

by Vendan 11y ago

kyrra 11y ago

A global salt for all your stores passwords at least prevents generic rainbow tables from being used against a stolen password database. Salts per password prevents the same password from having the same hash result in your database.

bschwindHN 11y ago
There's really no reason to ever use a global salt, it's not like it's hard to generate a random one for each user. If you're already putting in the effort to use salts, might as well go all the way instead of saying "well it's better than nothing ¯\_(ツ)_/¯" (I'm not directing this at you in particular, just at anyone who intentionally takes half-measures when it comes to security)
- z92 11y ago
  Theres always will exist an option of having more security, than whatever is already providing by any system. That brings up the question: when, choosing to not include more security, isn't considered a bug?
  - toolz 11y ago
    Not sure where the line is drawn, but it's definitely inclusive of the more secure option when it can be implemented in <10 LoCs of code simple enough 99% of the professional dev community can write it.
    - Vendan 11y ago
      Even worse, using an actual password hashing lib, i.e. golang.org/x/crypto/bcrypt, is usually going to take care of it for you. 2 lines of code, 1 to make the hash when the password changes, 1 to check if the password matches the hash, and you are done!(as the library already generates and includes random salts in the hash for you)
- adrusi 11y ago
  Last pass used both: a global salt and a per-password salt. The idea was that the global salt isn't stored in the database so if the attacker doesn't have access to the application server, they cant find what that salt is at all.

darkr 11y ago

> A true salt should not be reused at all. I agree with the practice of salt non-reuse, but it's not a part of the definition of. A nonce on the other hand does mandate non-reuse.