3 ms·
Passwords are hashed because users constantly reuse them between sites. If they didn't do that there would be no reason to hash them.
by sbierwagen 5y ago
Passwords are hashed because users constantly reuse them between sites. If they didn't do that there would be no reason to hash them.
- ezekg 5y agoNo, passwords are salted because they are reused...
- tptacek 5y agoThis is not true at all. This whole discussion is pretty confused. All of the mitigations we apply to passwords are premised on passwords being (1) cryptographically weak, (2) irrevocable, and (3) infectious to other systems. Nerds are, for reasons I will never understand, hyperfixated on "salting". Randomized password hashes primarily address an old attack that is more or less irrelevant to any modern hash or KDF. But that attack, too, mattered because (1), (2), and (3) hold for passwords.
- kortex 5y agoI thought salting+hashing was primarily to mitigate damage in an event of someone scooping the credentials data store. And/or bruteforcing. If there were one login system/site in the whole world, you'd still want to hash/encrypt them. I mean hashing is one of the easiest things to do to add a layer of security, so even if the db is encrypted, why not? Maybe I'm missing your point.