3 ms·
If I'm using bcrypt or scrypt, adding the pepper buys me next to nothing. The only case where the pepper improves security is if I'm not crypting the passwords
by akerl_ 12y ago
If I'm using bcrypt or scrypt, adding the pepper buys me next to nothing. The only case where the pepper improves security is if I'm not crypting the passwords properly before storing them.
- FiloSottile 12y agoI think I address this in the article. If an attacker gets the DB dump of your "perfectly crypted" passwords, they can still bruteforce the easy ones (or sites would not tell users to change passwords, no?) while with pepper it would be really impossible.