Re:If it's a nice problem to have, don't solve it now
by twiss on Monday August 10, 2020 @01:20PM
(#24111661)
In addition to the sibling answer of "use a framework"; if you simply stick passwords in a database, and the database gets stolen, you've now leaked your users' passwords. So you should hash the passwords, and they should be salted, so now you need a `salt` column. Most people use too cheap a hash function, so this is an additional argument for using a library / framework.
[ Parent
| on HN ]
Re:If it's a nice problem to have, don't solve it now
by tonyarkles on Monday August 10, 2020 @01:53PM
(#24111996)
As a minor nit, most salted password hash algorithms store the salt at the start (usually) or end (occasionally) of the hash, so you don't need a separate column. You end up with two functions: one to generate a new password hash (which securely generates a salt as well), and one to compare a plain-text password with the (salt+hash).