4 ms·
Wow, using the user as the salt is awesome. Is this considered an ok security practice?
by nhumrich 9y ago
Wow, using the user as the salt is awesome. Is this considered an ok security practice?
- Amorymeltzer 9y agoNah, user logins/emails often won't be long enough or random enough. See https://security.stackexchange.com/a/8024/28881 https://security.stackexchange.com/a/8024/28881 and https://stackoverflow.com/a/5565071/2521092 https://stackoverflow.com/a/5565071/2521092
- swsieber 9y agoWould it be an okay practice to prepend the username as extra salt, still using the randomly generated salt?
- ad-hominem 9y agoNo, the hashed passwords will be way too salty and will throw off the flavor of the app
- Amorymeltzer 9y agoWhy not just use a longer salt? The username is only going to reduce randomness. Moreover, I don't buy the presumed advantage: nobody is really parsing that message to mean someone else could have the same password.
- marcosdumay 9y agoBe careful about how you merge the username and the random salt.
- Aissen 9y agoWhy would anyone use that ? Best practices require that every user has a random (probablistically) unique salt. Just use bcrypt, or other password hash functions.
- deleted 9y ago[deleted]