Re:Peppering (Password Storage)
by willcipriano on Thursday July 02, 2020 @07:12AM
(#23711978)
No, because the static salt will be stored in the database alongside the passwords. The pepper would be compiled and live in the application layer. The value is minimal but so is the cost.
If it's static salt, it breaks the use of salt.
Salt was designed such that a rainbow table cannot crack two similar passwords based on hash, exactly what a static salt would facilitate.
If not stored in the database, it ensures that a database dump alone isn’t enough to recover even a single password. It certainly doesn’t have the level of impact that salting passwords or using a cpu-hard and memory-hard hash does, but it’s certainly something.
Modern password hashes like argon2 include this feature natively.
I don't see any value of a pepper. It doesn't actually add any protection.