4 ms·

> Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salt

• bryanh 14y ago
  Most implementations store the salt with the hash itself. Take Django's storage of "password" for example: pbkdf2_sha256$10000$rdfyoPhMNhnC$3QEJ9hp0Qe68/p8+b1tVsYmNqVHiFrhmpWizXq+xQoo= Which of course stores it as: algo $ iterations $ salt $ hash Salts simply protect against rainbow tables and force CPU cycles to be re-spent on each password individually. But to answer your question: I'm not sure, but probably.
• pixl97 14y ago
  Of course, every password should have a large individual salt to prevent rainbow tables. A hidden salt that is used across all passwords is useless on a public service, because that becomes the password to hack. The attacker takes an account that has a known password and brute forces the salt from that. Salt and hash are good for protecting well chosen passwords, but because the speed they can be processed mean the hacker can try billions of different passwords a second. These days choosing a cryptographically hard (memory hard) is the best bet to extend the time from a breach to password discovery so the majority of the users can change their password.