News for hackers. Stuff that matters.

A comment on The man who wrote the book on password management regrets the error. Parent comment

Re:The man who wrote the book on password management regrets... by corobo on Wednesday August 09, 2017 @10:38AM (#14969407)
Don't sites also salt (and pepper?) passwords though? Does this still apply in the scenario that they have done so?

Edit: Realised Google exists, currently reading https://stackoverflow.com/questions/16891729/best-practices-...

[ Parent | on HN ]
Re:The man who wrote the book on password management regrets... by dspillett on Thursday August 10, 2017 @06:59AM (#14978428)
> Don't sites also salt (and pepper?) passwords though?

They should salt. They should do many things. But we know some sites don't, we suspect many sites don't. Unless you know otherwise never assume a site is handling your data, including your login credentials, securely.

[ Parent | on HN ]
Re:The man who wrote the book on password management regrets... by Bartweiss on Wednesday August 09, 2017 @11:00AM (#14969686)
That math is for fast hashes without salting, agreed. Of course, plenty of sites that lose passwords also make those mistakes...
[ Parent | on HN ]