News for hackers. Stuff that matters.
Re:Peppering (Password Storage) by georgyo on Thursday July 02, 2020 @07:07AM (#23711955)
Your pepper is always static, and your salt becomes static. Wouldn't that essentially be peppered even without the pepper?

I don't see any value of a pepper. It doesn't actually add any protection.

Re:Peppering (Password Storage) by willcipriano on Thursday July 02, 2020 @07:12AM (#23711978)
No, because the static salt will be stored in the database alongside the passwords. The pepper would be compiled and live in the application layer. The value is minimal but so is the cost.
Re:Peppering (Password Storage) by Sherl on Thursday July 02, 2020 @08:23PM (#23719643)
If it's static salt, it breaks the use of salt. Salt was designed such that a rainbow table cannot crack two similar passwords based on hash, exactly what a static salt would facilitate.
Re:Peppering (Password Storage) by stouset on Thursday July 02, 2020 @12:17PM (#23714874)
If not stored in the database, it ensures that a database dump alone isn’t enough to recover even a single password. It certainly doesn’t have the level of impact that salting passwords or using a cpu-hard and memory-hard hash does, but it’s certainly something.

Modern password hashes like argon2 include this feature natively.