6 ms·
Yes, and yes passwords are encrypted / salted. They’re not morons.
by shove 9y ago
Yes, and yes passwords are encrypted / salted. They’re not morons.
- jlgaddis 9y ago>> ... limited users to 12 character passwords? > Yes ... They’re not morons. That seems debatable.
- shove 9y agoTo be fair, some of them are morons. There are morons at any organization of sufficient size. I wasn't on the teams handling security, account login / access, etc so I can't speak to specific implementations (nor would I), but the folks I interacted with were super sharp.
- greenhouse_gas 9y agoEncrypted? You mean reversible encryption. I hope not. Salted? Just once? Or through something like bcrypt or scrypt? Because just salting nowadays is pretty much useless.
- mfjordvald 9y agoYou're misunderstanding the terms a bit. Salting is only done once because it's a random string you apply to the users password so that if two users use the same password they do not result in the same hash. This is primarily meant to combat pre-generated rainbow tables and forcing each password to be broken individually. You're thinking of multiple rounds of hashing, designed to increase the computation cost of the hashing. For example Bcrypt has a built in cost factor. While this is definitely important it's not quite the same as salting.
- sgt101 9y agoCan you provide a reference to the uselessness of salting. If it is useless many people need to know!