News for hackers. Stuff that matters.

A comment on Peppering (Password Storage).

Re:Peppering (Password Storage) by simonebrunozzi on Wednesday July 08, 2020 @09:16PM (#23776066)
> One solution to this is to store the ID of the pepper in the database alongside the associated password hashes

Wouldn't this expose the pepper to Database attacks (SQL injections, etc), and invalidate the reason for using it in the first place?

[ Parent | on HN ]
Re:Peppering (Password Storage) by yencabulator on Thursday July 16, 2020 @01:17AM (#23856016)
ID of the pepper, not the pepper itself.
[ Parent | on HN ]