Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is missing something pretty important about salts. They hide the fact that two users have the same password. That's a huge security risk if that correlation is leaked.

Correct me if this is mentioned in the article, but based on several mentions of how salts were effectively useless, I think this was overlooked.



I didn't get the impression the author was saying salts are useless, obviously you still have to use them and bcrypt and scrypt both do. The point is that a lot of programmers naively assume that a salt (or salt+pepper) will make their password storage secure on its own when that isn't really true anymore.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: