Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Having the exact salt in the same database as the user data defeats the purpose of the salt.

Normally you have a global salt, somewhere in your source-code, which you combine with the per-user generated salt. It also doesn't have to be something obvious in the database (like a column named user_salt :)), you could just use something like HMAC_MD5(global_salt, email + username + joined_date) for each user.

Of course, this may seem like security by obscurity, but even in the case of SSH you keep your private key safe and as a business if you have both your database and your source-code compromised, you're fucked anyway.



How does it defeat the purpose of the salt?

The purpose of the salt is to defeat time/space tradeoff attacks by inflating the required space to the point of impracticality. ie. 20 bits of salt will increase the size of the rainbow table required a million times.


immutable fields are probably recommended for salts ... I quite like being able to change my email address on a site ;-)

but yes, a hashed (global + immutable-user-specific) combination seems to be best practice.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: