We didn't encrypt your password, we hashed it

Re:We didn't encrypt your password, we hashed it by blntechie on Friday September 04, 2020 @09:23PM (#24380637)

Is it worth it to salt in scenarios when the passwords (actually tokens) themselves are guaranteed to be unique and instead only use pepper?

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by couchand on Friday September 04, 2020 @11:37PM (#24381239)

Short answer: if they are unique because they're a small sample from a large space (e.g. UUID v4) no salt is needed. If they're unique but maybe predictable, salt.

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by blntechie on Saturday September 05, 2020 @03:58AM (#24382060)

Thanks! Yes, they are random GUID-like values and are short lived (2-4hrs). Had a need to store them for a reason and decided to only add pepper to hash considering they are unique and short lived anyway.

[ Parent | on HN ]