4 ms·
Yes, it's a great idea. It's called "salting" the password. Everyone does it. It works really well. Of course, if they can steal your salt (from your source,
by wisty 14y ago
Yes, it's a great idea.
It's called "salting" the password. Everyone does it. It works really well.
Of course, if they can steal your salt (from your source, or a config file) then you lose.
- JshWright 14y agoWhat's the OP is talking about is commonly called a 'pepper'. Some fixed secret in your application code that impacts the generated hash. Since salts are random, and unique per password, you shouldn't be storing them in a config file.