Hacker News new | past | comments | ask | show | jobs | submit login

Ya, that's silly.

A common and simple password setup is hash(username+password) or hash(private_account_attribute+password).

Also, use bcrypt/scrypt/similar.




> Ya, that's silly.

Not exactly. Having a salt at all mitigates rainbow table attacks, having a unique salt per password also limits brute-force attacks (you can't brute-force the whole table trying out cleartexts with a given salt, you have to brute-force each password individually).

Having a global unique salt is already better than no salt at all.


I have heard of doing both, though I have not seen it yet in production. It gives the benefit of having to get the code and the database while also requiring dictionaries to be build per password.


I think the considered opinion of "the people in the know" is that getting the code is just not that hard, and the global secret technique offers more illusory security than real security.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: