4 ms·

Salt is bad for you: http://news.ycombinator.com/item?id=1209254 http://news.ycombinator.com/item?id=1209254

• cookiecaper 16y ago
  Salted hashes are better than unsalted hashes.
  • seiji 16y ago
    Against a GPU that can calculate five million hashes per second your salt isn't worth the paper it's printed on.
    • jbri 16y ago
      I don't know about you, but personally I think "crack one person's password in one day" is a much better situation than "crack everyone's password in one day".
    • ceejayoz 16y ago
      That's why you use a different salt per user.
    • perlgeek 16y ago
      Who prints out password salts anyway?
    • phsr 16y ago
      So we should just store the password in plain text then!! Or we could use the honor system, with no password!!
  • TimothyBurgess 16y ago
    If you insist on using fast hashes, a double salt double hash sandwich is what I use. sha1($Salt . sha1($Food . $Salt)) Something like this should be used at a minimum - maybe even toss some herbs and spices in there and hash it a couple more times for good measure. And I know this from my own experience in finding security holes. wink