2 ms·
not storing the password in sql has nothing to do with obscurity. In fact, it's smart. You do not understand what "security through obscurity" means. Following
by zobzu 15y ago
not storing the password in sql has nothing to do with obscurity. In fact, it's smart.
You do not understand what "security through obscurity" means.
Following your train of though, we should display the salt and the hash publicly. That is extremely dumb.
Put your passwords in your post, otherwise you'll be doing security through obscurity! oh snap?
- eneveu 15y agoThat's not what I said. Some amount of secrecy might better than none. But, you should not depend on it. If you use a "clever" scheme to store / generate your salt, you make your system more complex in an attempt to hide something that does not really need to be hidden. You might also end up introducing implementation flaws. That's why bcrypt uses nonces for its salts, and simply appends them to the encrypted passwords. Also see http://en.wikipedia.org/wiki/Kerckhoffs%27s_Principle http://en.wikipedia.org/wiki/Kerckhoffs%27s_Principle