5 ms·
In a case like the Gawker incident, it isn't safe. If the source code to the password hashing algo is compromised (it was) then the salt becomes useless. In sho
by ax0n 16y ago
In a case like the Gawker incident, it isn't safe. If the source code to the password hashing algo is compromised (it was) then the salt becomes useless. In short, just use bcrypt.
- Xk 16y agoNo. No no no. The source code to the hashing algorithm means nothing. It is already open source! The reason that the salt is there is to prevent against rainbow tables. The salting did NOT become useless. If they had not salted passwords, then many many more passwords would have been broken because instead of having to brute force each and every one, you'd just look it up in a massively large hash table.
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- jrockway 16y agoNo, he thinks the salt is stored secretly in the source code. Of course, it's not; you store it right next to the hash so that you don't have to use the same salt for every password.
- aidenn0 16y agoSalting and choice of hashing algorithm are orthogonal. If it takes X amount of time to brute force a password of strength Y and you do salt, then an attacker can crack N passwords of strength Y in time NX. If you don't salt, then an attacker can crack all* passwords of strength Y in time N, which is a huge difference.
- ax0n 16y agoAlas, I stand corrected. Thanks. At the same time, the author does have a good point that very slow algorithms are fundamentally better for security, but I'm glad you pointed this difference out. Classic case of me not thinking things all the way through.