3 ms·

Is the seed a sitewide one or unique per password?

• andrewjshults 16y ago
  Since the username is unique, I tend to use a sitewide seed. My understanding of the seed is to make rainbow tables useless, so adding any unique data should help with that. Granted, now that you can fire up a GPU instance on EC2 and generate SHA1's like a madman, bcrypt does seem to be the way to go, but at least (as far as I can tell, would love to hear if my reasoning is incorrect) by including the username + password, you'd need to generate those rainbow tables against each user.
  • cheald 16y ago
    That's correct, but as you pointed out, with massively parallel cloud computing available for so cheap, you really want a slow function to shove that data through.