3 ms·
But, specific to Gawker's case -- where the databases and source code are compromised, this would not work, correct? There'd have to be some salt that does not
by smoody 16y ago
But, specific to Gawker's case -- where the databases and source code are compromised, this would not work, correct? There'd have to be some salt that does not exist in the database, config files, or source code. I guess one could, as a (weak) added level of security, pass-in values when a server is spun-up (or apache, etc) that are part of the launching of apps, but not store in files of any kind.
- njg 16y agoThe salt has to be present in your system so you can use it to hash the provided password and check that it matches the hash you have on file. People usually keep it right next to the password. The salt serves two functions: Make rainbow table attacks more difficult Obscuring cases where two users have the same password. If two users both use "blah7$monkey" as their password and you don't use a salt, they will hash to the same value. If I steal your password database and I want to compromise one account, a salt offers no protection. Hash algo and password strength are what matter.