3 ms·
Ah, I did not know that. And I wrote some password hashing with a global salt myself. So I stand by my comment with "one laughing and one crying eye". I thought
by aw3c2 13y ago
Ah, I did not know that. And I wrote some password hashing with a global salt myself. So I stand by my comment with "one laughing and one crying eye". I thought salts were mostly against precomputed rainbow tables for specific hash functions, but of course if my hashes are valuable enough, a global salt makes cracking them easier than if I used a random/unique one per hash.
- sillysaurus2 13y agoThis is why programmers should stop trying to write their own password systems.
- amenod 13y agoTo be exact, programmers should stop using their own password systems (unless - well, let's not go there :). Writing them is actually an excellent exercise, and humbling one too. Especially if you show your code to some skilled hacker / security expert.
- jtheory 13y agoFrom what I understand rainbow tables are not really used anymore -- they were useful when it took longer to calculate hashes, but nowadays you just need a decent graphics card to calculate a few billion hashes (MD5 or SHA1) PER SECOND. Per-hash salts don't really slow that down at all, unfortunately. Short-version: don't use the hash algorithms that are designed to be fast for protecting sensitive data; use something solid with a work factor instead.