3 ms·
What worries me is that most competent people in the industry still ask whether passwords were salted and hashed, rather than whether they used a key derivation
by venomsnake 14y ago
What worries me is that most competent people in the industry still ask whether passwords were salted and hashed, rather than whether they used a key derivation function.
Maybe because even that weak protection is still rare. It is the equivalent of "Did you plug it" in tech support.
- rlpb 14y agoSure. I'm certain that there are competent developers who are aware of KDFs but still ask for salting for the reason you described. The problem I perceive is that other developers learn from this question. They falsely learn that salting is the best practice answer, when it is not.