3 ms·
I think the others are missing the fact that if you use the same salt for every row, it's less secure. So you'll be storing the email more securely, but still
by wccrawford 6y ago
I think the others are missing the fact that if you use the same salt for every row, it's less secure. So you'll be storing the email more securely, but still not as securely as you should be storing the password.
To do it any more securely would require pulling up every single record for its salt, and hashing the login with that salt and checking it. It's virtually impossible at any real scale.
- raziel2p 6y agoHah, when I wrote my comment above I didn't even consider the possibility of using the same salt everywhere. I suppose the goal here is privacy, not information security, so it's okay.
- benlivengood 6y agoIt's pretty scalable. 10 billion email addresses times 16+32+4 bytes of salt, SHA512/256, and ID is 520GB of RAM; available in a single (big) machine and searchable in under a second with a few cores. Shard it into multiple machines for higher QPS.