4 ms·
Also well documented are attacks against stores of hashed passwords, esp. pre-built dictionary attacks. There are more ways to do that wrong than right. Of co
by PeterWhittaker 2y ago
Also well documented are attacks against stores of hashed passwords, esp. pre-built dictionary attacks.
There are more ways to do that wrong than right.
Of course, that is irrelevant to my point: even if you do store them all properly, you are still going to get attacked.
Don’t give people such terrible advice unless you also tell them how to protect themselves.
- kcartlidge 2y agoThe phrase 'terrible advice' is unwarranted when it comes to a simple comment saying to use one-way cryptographic hashes rather than storing passwords. I offered a technically correct warning for a single case, and also specifically said I wasn't commenting on whether that auth method should be used or not. I'm not required to offer a security tutorial, but yes it's true that storing anything, even hashes, is a security risk. So if it helps any other readers they can somewhat mitigate dictionary attacks by using salts and possibly peppers.