Re:Operation Luigi: How I hacked my friend without her noticing
by ameliaquining on Thursday August 03, 2017 @12:25PM
(#14920984)
The talk page mentions "pepper" having two meanings, both of which are mentioned in the article. I wasn't familiar with the one that involves brute-forcing it on every login attempt, and I've never heard of it being used in production on a real site (whereas a global shared secret seems to be reasonably common).
Re:Operation Luigi: How I hacked my friend without her noticing
by cyphar on Thursday August 03, 2017 @01:18PM
(#14921541)
> I wasn't familiar with the one that involves brute-forcing it on every login attempt, and I've never heard of it being used in production on a real site (whereas a global shared secret seems to be reasonably common).
In case you're interested, that is the same scheme as the one used by JoeyH's keysafe[1].
"The pepper is randomly generated for each value to be hashed (within a limited set of values), and is never stored. When data is tested against a hashed value for a match, this is done by iterating through the set of values valid for the pepper, and each one in turn is added to the data to be tested (usually by suffixing it to the data), before the cryptographic hash function is run on the combined value."