News for hackers. Stuff that matters.

A comment on Using pepper to increase the security of stored passwords. Parent comment

Re:Using pepper to increase the security of stored passwords by MattPalmer1086 on Monday March 04, 2019 @05:53AM (#19300284)
I wouldn't say don't do this, although you do have to spend your security resources carefully.

While it only provides additional security against password database exfiltration attacks, it is also a very, very low cost mitigation.

It could equally be used in a separate authentication service as one of the many ways to harden it.

[ Parent | on HN ]
Re:Using pepper to increase the security of stored passwords by tptacek on Monday March 04, 2019 @01:02PM (#19303527)
I'm saying don't do this; it's a cosmetic defense.
[ Parent | on HN ]