News for hackers. Stuff that matters.
Re:Notice of Security Incident by earblast on Wednesday June 05, 2019 @06:27PM (#20109765)
What can someone use as a salt that is unique to a user that would not be in that record as plain-text and guess-able? Creation timestamp? email? username?
Re:Notice of Security Incident by c22 on Wednesday June 05, 2019 @07:03PM (#20109995)
Just use a random value and store it with the hashed password. The salt is there to prevent an attacker from using a rainbow table to search your whole database for known passwords. Even if they have all your hashes and all your salts the fact the salts are unique forces them to attack each hash individually.

What you're looking for is a pepper [0]

[0] https://en.wikipedia.org/wiki/Pepper_(cryptography)

Re:Notice of Security Incident by earblast on Thursday June 06, 2019 @10:23AM (#20114813)
Hmm, seems to me using both is optimal

horrible psuedocode follows...

  cryptchoice = len(username) % 3

  switch cryptchoice:
     case 0:
       pepper = pepper[1]
       salt = email

     case 1:
       pepper = pepper[0]
       salt = creation_time
       
     case 2:
       pepper = pepper[2]
       salt = username
       
  bcrypt(salt+password+pepper)
Re:Notice of Security Incident by c22 on Friday June 07, 2019 @02:31AM (#20122142)
It's definitely wise to use both a salt and a pepper when hashing passwords. Don't bother with the switch statement, though, it's just security through obscurity. You're much better off keeping your security-related code as simple as possible so it's easier to notice bugs in it.