4 ms·
What about using a unique salt for each user. For example, if you use the user's login name. Then, the hacker would have to make a rainbow table for each user,
by notJim 16y ago
What about using a unique salt for each user. For example, if you use the user's login name. Then, the hacker would have to make a rainbow table for each user, in essence.
I think bcrypt is probably still more secure? Or maybe the best would be to combine both.
- asharp 16y agoBcrypt would be more secure. The problem is that by using a unique salt per user, you can't simply create one salted hash and use it on every user hash simultaneously, however you can still check one password each hash you generate. Bcrypt/scrypt are more secure as it requires much more effort to check each password.
- jtheory 16y agoRight; see "Salt will not help you" here: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ The standard hash algorithms are designed to be fast executing. They're built for determining uniqueness quickly, not for securing passwords.
- tesseract 16y agoAre you saying there are salting systems that don't use a unique salt for each user?
- anthonyb 16y agoYeah - normally crappy hand rolled PHP ones.