2 ms·
"That operator better type carefully, because there's no way to check whether he's "right", and any mistake will screw up everything :)" Why can't the system k
by axod 18y ago
"That operator better type carefully, because there's no way to check whether he's "right", and any mistake will screw up everything :)"
Why can't the system know the hash of the salt and check that? Getting from the hash of the salt back to the salt would be pretty impossible.
- sho 18y agoLol, you got me there. Yes, OK, if you have an operator standing by 24 hours a day to type in a long secret phrase which will not be stored on disk and will be used as a salt in hashes stored by the system, and will infallibly ensure the server does not fall into the wrong hands in a running state, and there are no other attack vectors, then that is kind of secure. Since your system relies on a secret key, though, you may as well just use encryption in the first place rather than going to these absurd lengths to hammer hash functions into an encryption-shaped hole.