4 ms·

I'm naive about these things, but I was under the impression that salt just thwarted pre-computed hash tables? I guess should be "just" in quotes. So somebody

I'm naive about these things, but I was under the impression that salt just thwarted pre-computed hash tables? I guess should be "just" in quotes. So somebody with resources and motive could still brute-force that string. It seems that storing the salt somewhere else would add a comparable amount of security as the salt itself. It seems prudent along the lines of "don't put all your eggs in one basket."

CiPHPerCoder 10y ago
What you're thinking of is called a "pepper" and is discouraged.
raverbashing 10y ago
> but I was under the impression that salt just thwarted pre-computed hash tables? Yes. Because if you had two users with the password 'dadada' they would hash to the same value Now 1234:dadada hashes differently then 1326:dadada hence preventing the use of a prehashed table (you could go through all salts for common passwords, but it's usually a bit long as well)