Re:“Username or password is incorrect” is bullshit
by nhumrich on Friday December 22, 2017 @07:47AM
(#15987053)
Wow, using the user as the salt is awesome. Is this considered an ok security practice?
[ Parent
| on HN ]
Re:“Username or password is incorrect” is bullshit
by Aissen on Friday December 22, 2017 @08:13AM
(#15987167)
Why would anyone use that ? Best practices require that every user has a random (probablistically) unique salt. Just use bcrypt, or other password hash functions.
Re:“Username or password is incorrect” is bullshit
by Amorymeltzer on Friday December 22, 2017 @08:10AM
(#15987150)
Nah, user logins/emails often won't be long enough or random enough. See https://security.stackexchange.com/a/8024/28881 and https://stackoverflow.com/a/5565071/2521092
Re:“Username or password is incorrect” is bullshit
by swsieber on Friday December 22, 2017 @10:56AM
(#15988330)
Would it be an okay practice to prepend the username as extra salt, still using the randomly generated salt?
Re:“Username or password is incorrect” is bullshit
by Amorymeltzer on Friday December 22, 2017 @12:24PM
(#15989138)
Why not just use a longer salt? The username is only going to reduce randomness. Moreover, I don't buy the presumed advantage: nobody is really parsing that message to mean someone else could have the same password.
Re:“Username or password is incorrect” is bullshit
by marcosdumay on Friday December 22, 2017 @01:12PM
(#15989561)
Be careful about how you merge the username and the random salt.