3 ms·
It is if somebody figures out what you're doing, or if you tell them, like you just did... The whole point of doing it randomly is that even if somebody figure
by LargeWu 17y ago
It is if somebody figures out what you're doing, or if you tell them, like you just did...
The whole point of doing it randomly is that even if somebody figures out the salt for one user, they would still need to figure it out individually for every other user too. Using a "system", like you're doing, significantly decreases the effort required to figure out the salt.
I think it was in WWII where the Americans would intercept the German broadcasts, which were encrypted by Enigma. But because the Germans routinely broadcast the same sorts of information in the same format every day - weather reports, for example, it gave the US a known set of data of limited scope which significantly improved their chances of breaking the codes. What you are doing, especially because you're broadcasting it on the internet, is essentially the same thing.
- cschneid 17y agoI disagree. Salts are not secret. The passwords are. The idea is that it just prevents massive pre-computation attacks, where the same set of precomputed hashes can be reused. At the point there are salts introduced (different for each user), there's no way to precompute a huge rainbow table and use it. So from my un-trained-in-cryptography eyes, the username approach is solid.
- LargeWu 17y agoYes you are correct. I'm not sure what I was thinking there.