3 ms·
If the attacker has one known password in the database, finding the pepper has the same difficulty as finding one password in a DB without pepper.
by bnr 14y ago
If the attacker has one known password in the database, finding the pepper has the same difficulty as finding one password in a DB without pepper.
- masklinn 14y agoThat is not entirely true: the pepper is usually randomly generated, so a "smart" brute-forcing tool (using combinations and substitutions on a base corpus) will have a much harder time matching something.