3 ms·
Nah, user logins/emails often won't be long enough or random enough. See https://security.stackexchange.com/a/8024/28881 https://security.stackexchange.com/a/8
by Amorymeltzer 9y ago
Nah, user logins/emails often won't be long enough or random enough. See https://security.stackexchange.com/a/8024/28881 https://security.stackexchange.com/a/8024/28881 and https://stackoverflow.com/a/5565071/2521092 https://stackoverflow.com/a/5565071/2521092
- swsieber 9y agoWould it be an okay practice to prepend the username as extra salt, still using the randomly generated salt?
- ad-hominem 9y agoNo, the hashed passwords will be way too salty and will throw off the flavor of the app
- Amorymeltzer 9y agoWhy not just use a longer salt? The username is only going to reduce randomness. Moreover, I don't buy the presumed advantage: nobody is really parsing that message to mean someone else could have the same password.
- marcosdumay 9y agoBe careful about how you merge the username and the random salt.