4 ms·

The fact that the pepper can't be changed/rotated far outweighs any upsides

• cpeterso 12y ago
  You can change your pepper by double-peppering your existing password database: scrypt(scrypt(scrypt(scrypt(password, salt), pepper2013), pepper2014), pepper2015) https://blog.filippo.io/salt-and-pepper/ https://blog.filippo.io/salt-and-pepper/
  • deleted 12y ago
    [deleted]
  • flurdy 12y ago
    Sounds like a maintenance nightmare. Need to ensure you keep your tongue straight when partitioning or restoring databases, migrating/splitting to new apps etc.