4 ms·
As Anne_Ominous wrote in the comments, this solution needs salts to be truly secure. One reply to Anne links to a sentence in the bcrypt-ruby docs: "bcrypt-ruby
by roryokane 16y ago
As Anne_Ominous wrote in the comments, this solution needs salts to be truly secure. One reply to Anne links to a sentence in the bcrypt-ruby docs: "bcrypt-ruby automatically handles the storage and generation of these salts for you.". However, there's something I don't understand. Where are the salts stored? The linked article mentions only that the model needs a password_digest field. If the salt is stored alongside it, shouldn't we need a password_salt field too? And if the salt is stored in a separate database, isn't that inefficient and unscaleable?
- bodhi 16y agoI believe, but I'd have to go check bcrypt to make sure, that the salt is stored as part of the digest. Edit: Actually, after minimal research, I see that salting the password is handled by the bcrypt ruby gem.
- michaelfairley 16y agobcrypt stores the salt alongside the hash, so a single field is sufficient.
- createaccount94 16y ago>> hash = BCrypt::Password.create '123456' => "$2a$10$khoJWZR3hVA8Qcm3lW6sp.BQGOFKGo2xHCeH2YfDcQVRltEGCJe0S" >> [hash.salt, hash.checksum] => ["$2a$10$khoJWZR3hVA8Qcm3lW6sp.", "BQGOFKGo2xHCeH2YfDcQVRltEGCJe0S"]