We didn't encrypt your password, we hashed it

Re:We didn't encrypt your password, we hashed it by mberning on Friday September 04, 2020 @05:39PM (#24379146)

I have wondered the same thing. Make it a piece of data that comes in from the environment or a secrets manager. It’s not bulletproof, but if done correctly seems like it makes the whole hashing scheme a little better.

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by lookingfj on Friday September 04, 2020 @05:51PM (#24379240)

If you are doing this isn't it pretty much the same as encrypting it with a key?

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by liambuchanan on Friday September 04, 2020 @05:59PM (#24379308)

encryption is non-deterministic

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by quesera on Friday September 04, 2020 @06:21PM (#24379468)

Some encryption algorithms are (effectively, but not literally) non-deterministic, e.g.: DUKPT, RSA-OAEP

Most encryption algorithms are deterministic, and most password authentication schemes depend on that fact.

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by srtjstjsj on Friday September 04, 2020 @06:45PM (#24379646)

Passwords aren't encrypted, so why would deterministic encryption matter?

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by quesera on Friday September 04, 2020 @07:56PM (#24380144)

Err, yes, good point. And if I had read the article first, I would have had the proper context of technical specificity loaded before commenting.

Nevertheless, most encryption algorithms are deterministic. :)

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by iso8859-1 on Friday September 04, 2020 @06:05PM (#24379358)

if that was true, this article wouldn't exist: https://en.wikipedia.org/wiki/Deterministic_encryption

[ Parent | on HN ]