4 ms·

But you can index the hashes. Hash the email first, then check if the hash exists.

• thijsvandien 9y ago
  To check for matches against that index, you'd still need to hash the email you're checking for with every distinct salt in your database, separately.
  • 0xfaded 9y ago
    Good point, if each email is individually salted as best practice for storing passwords they could not be indexed. However, this would also mean that logging in using an email/username would also require a full scan. More generally, if you want to uniquely salt your keys, you’re in trouble.
    • p49k 8y ago
      > However, this would also mean that logging in using an email/username would also require a full scan No it wouldn’t, and that’s what makes this specific case different. In your scenario, you can lookup the column you need by username or email, which is indexed. You can then retrieve the unique salt and password hash with no lookup penalty. This is not possible in the other case because there is no known column that can serve as the index.