3 ms·
but only the second salt is stored in a database, the first salt is stored under WWW-Root.
by Misiek 15y ago
but only the second salt is stored in a database, the first salt is stored under WWW-Root.
- gws 15y agoIt's still there on the server, if the attacker has her hands on the database you have to assume that the entire server might be compromised
- Misiek 15y agoWhat is the best way to secure passwords?
- gws 15y agoYou need to assume that the attacker will have access to anything on the server. So first thing is clearly no plain text passwords but hash only. Second thing is make as hard as possible for the attacker to decode the hash. One salt helps preventing use of rainbow tables but more salt is useless since the attacker has them. So you are left with choosing a hard algorithm to crack and currently the best one is bcrypt which is already implemented in most programming language for you.