4 ms·
It looks like you're storing an unsalted hash of the database's password in the plaintext header of the database itself. Is that correct? If so, this is a reall
by doomrobo 7y ago
It looks like you're storing an unsalted hash of the database's password in the plaintext header of the database itself. Is that correct? If so, this is a really really bad idea
- Jfreegman 7y agoAccording to the libsodium docs: >The string produced by crypto_pwhash_str() already includes an algorithm identifier, as well as all the parameters (including the automatically generated salt) that have been used to hash the password. https://libsodium.gitbook.io/doc/password_hashing/default_phf https://libsodium.gitbook.io/doc/password_hashing/default_ph...
- doomrobo 7y agoAha, looks like it's using a salt and iterated hashing under the hood. Thanks for the link.