3 ms·
If you want to advocate the usage of pre-built password libraries, go right ahead. But please find a way of promoting it without adding confusion about the use
by dsl 15y ago
If you want to advocate the usage of pre-built password libraries, go right ahead. But please find a way of promoting it without adding confusion about the use of salts.
- rimantas 15y agoLet me repeat: salt is built in.
- tptacek 15y agoIf you are adding your own salts, you are doing it wrong. There is no secure password storage scheme that doesn't randomize. What you are saying is morally equivalent to "if you want to use a preexisting block cipher that's fine, but don't confuse people about the need to use nonlinear substitutions". No, if you are designing your own s-boxes you are doomed. Use AES. This isn't worth arguing about except that you strike me as one of these people that think they're doing it right because they add salts to their hashes. No, you aren't.