3 ms·
No because competent companies don't just have peoples' passwords. They would have to give the encrypted password, encryption method and salt which would great
by pfisch 13y ago
No because competent companies don't just have peoples' passwords. They would have to give the encrypted password, encryption method and salt which would greatly weaken the companies own internal security because now a bunch of people know a lot about the encryption system of the company and those people can't be trusted to keep the information secure.
- Xylakant 13y agoGood encryption systems assume that the algorithm is known and still are secure in face of that requirement. So if publishing the method makes your system insecure then it's already insecure by design. Security through obscurity is not a viable approach.
- eToThePiIPower 13y agoYes, good encryption/hashing assumes the algorithm is known, but we're also talking about the giving away the salt. The salt in a secure hash plays an analogous role to the secret key in an encryption cipher; both are assumed unknown by an attacker.
- duncans 13y agoSecurity through obscurity?
- girvo 13y agoSTO is okay as a part of defence-in-depth, IMO.