5 ms·
A salt being public is usually fine. AFAIK most modern suggested hashing libraries use a random salt and store the salt in plaintext next to the hashed password
by txcwpalpha 7y ago
A salt being public is usually fine. AFAIK most modern suggested hashing libraries use a random salt and store the salt in plaintext next to the hashed password anyway. A properly salted-and-hashed password is still practically uncrackable even if the attacker knows the exact salt used.
- flatiron 7y agoi've always stored the salt plain text, how else do you store a salt? i need to be able to use it with 0 information about the user other than "they are trying to use this password"
- txcwpalpha 7y agoI've seen lots of people under the false impression that salts need to be kept secret, and jump through some hoops to do stuff like encrypt salts before storing them. Well intentioned, but misinformed and error prone, and likely indicates that they're not using standard login/password hash libraries and might be doing other things wrong, too.