Re:We didn't encrypt your password, we hashed it
by skissane on Friday September 04, 2020 @10:16PM
(#24380880)
> But what about having separate auth sub-service with separate database.
Sure, my point was mainly about classic monolithic apps. If you split your app up into lots of separate micro-services, my point may no longer hold.
> Who says a SQL injection allows yourself to update your account to be admin.
I wasn't talking about a database superuser account, I was talking about an application-level admin. Usually there is some database table which stores user permissions, and an attacker can do an UPDATE/INSERT on that table to grant an ordinary user account full admin permissions, or even create a brand new user with those permissions. All this can happen within the single ordinary DB account used by the application (given most applications only use one DB account)
But what about having separate auth sub-service with separate database.
Who says a SQL injection allows yourself to update your account to be admin. (SQL has their own permission system even through its not used that much).
Who says making yourself application admin allows yourself to do more then banning users.
Sure for many especially smaller systems pepper won't help much and AD (additional data) is even less likely to help.
But for many (especially bigger/enterprise) systems this might very well not be the case.
Furthermore pepper usage tend to not really hurt.
I think it's a fallacy to assume just because many less well build systems allow SQL injection to escalate that all do so and pepper is useless. Especially given that most systems need to have some config secret management system anyway and as such adding a pepper tend to be somewhat cheap to to (dev effort) and doesn't really cost much at runtime either (normally).