3 ms·
If the salt is the same for all the users you can have it on the source code that hashes the passwords. Not always being SQL injected means having the back-end
by miguelpais 15y ago
If the salt is the same for all the users you can have it on the source code that hashes the passwords. Not always being SQL injected means having the back-end code leaked.
- tedunangst 15y agoThat defeats the purpose. The whole point is to have a unique salt per user to force the cracker to spend time on every password.