4 ms·
Your pepper is always static, and your salt becomes static. Wouldn't that essentially be peppered even without the pepper? I don't see any value of a pepper. I
by georgyo 6y ago
Your pepper is always static, and your salt becomes static. Wouldn't that essentially be peppered even without the pepper?
I don't see any value of a pepper. It doesn't actually add any protection.
- willcipriano 6y agoNo, because the static salt will be stored in the database alongside the passwords. The pepper would be compiled and live in the application layer. The value is minimal but so is the cost.
- Sherl 6y agoIf it's static salt, it breaks the use of salt. Salt was designed such that a rainbow table cannot crack two similar passwords based on hash, exactly what a static salt would facilitate.
- stouset 6y agoIf not stored in the database, it ensures that a database dump alone isn’t enough to recover even a single password. It certainly doesn’t have the level of impact that salting passwords or using a cpu-hard and memory-hard hash does, but it’s certainly something. Modern password hashes like argon2 include this feature natively.