3 ms·
To check for matches against that index, you'd still need to hash the email you're checking for with every distinct salt in your database, separately.
by thijsvandien 8y ago
To check for matches against that index, you'd still need to hash the email you're checking for with every distinct salt in your database, separately.
- 0xfaded 8y agoGood point, if each email is individually salted as best practice for storing passwords they could not be indexed. However, this would also mean that logging in using an email/username would also require a full scan. More generally, if you want to uniquely salt your keys, you’re in trouble.
- p49k 8y ago> However, this would also mean that logging in using an email/username would also require a full scan No it wouldn’t, and that’s what makes this specific case different. In your scenario, you can lookup the column you need by username or email, which is indexed. You can then retrieve the unique salt and password hash with no lookup penalty. This is not possible in the other case because there is no known column that can serve as the index.