14 ms·
Easy Password Hash Enhancement
- dllthomas 14y agoIs it common practice to use one salt value across an entire site? I thought the idea was to generate a random salt for each user, in which case adding the username doesn't really buy us much extra. Applied Cryptography (from 1996!!!) seems to back me up on this, although it could be clearer about it. From the bottom of page 52, of the second edition: "Salt is a random string that is concatenated with passwords before being operated on by the one-way function. Then, both the salt value and the result of the one-way function are stored in the database on the host." If the salt wasn't re-generated for each password stored, there's not much reason to re-store it each time... Edited to add: Granted, it'd be better than what people are apparently doing!
- philip1209 14y agoInteresting. Most of the open-source projects I follow do a per-system salt. Isn't this how Wordpress does it? http://codex.wordpress.org/Editing_wp-config.php#Security_Keys http://codex.wordpress.org/Editing_wp-config.php#Security_Ke...