3 ms·
If used properly, can't the good hashing techniques be "safe", at least if the salt is not leaked?
by MasterScrat 12y ago
If used properly, can't the good hashing techniques be "safe", at least if the salt is not leaked?
- dchest 12y agoGood hashing techniques store "salt" along with password. Salt is not a secret key, it's a public value used to make password hashes unique. Good hashing techniques increase costs for attackers to brute-force passwords. If they securely encrypted passwords or password hashes, and the key was not leaked, then passwords are safe. However, the probability of attackers stealing the database of passwords and not stealing the encryption key for it is pretty low. Knowing anything of this still doesn't affect user actions, who should change eBay passwords and never reuse them for anything else.
- mnw21cam 12y agoYou're thinking of pepper, not salt. Salt is a random value that is added to a password before it is hashed, so that two identical passwords do not hash to the same value. The value is different for each hashed password, and is stored alongside the hash. Pepper is a configured value that is the same for all hashed passwords, and is added to the password (and salt) before it is hashed. It is kept secret, and effectively turns the hash function into a secret hash function. Its merit can be argued because if an attacker is able to compromise your hashed password database, they could possibly have compromised your configuration and discovered the pepper too. However, it does add an extra hurdle for an attacker.