3 ms·
>if they use the same salt for each password then the article is correct(ish). Wouldn't it be a pepper then? https://en.wikipedia.org/wiki/Pepper_(cryptograph
by La1n 6y ago
>if they use the same salt for each password then the article is correct(ish).
Wouldn't it be a pepper then?
https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography)
edit: nvm, it seems the main difference is a pepper being secret.
- cschneid 6y agoYep - a pepper is an app-wide value that forces an attacker to get both a configuration value (from the source, or env vars) and also the hashes of the passwords (a db dump). Just another incremental thing for an attacker to overcome that is cheap & easy to implement. Salts must be unique per password as far as I know? Otherwise they don't do their main goal which is to make every guess useful against only one hash. (ie: guess 'hunter2', check if any user had hunter2 as a password, but salted, you'd only be able to guess if cschneid had hunter2 since you'd be hashing hunter2-sssssaaaaallllltttt).
- rileymat2 6y agoYeah, I was trying to imply a correctish for a general audience. If right or wrong is a spectrum.