News for hackers. Stuff that matters.

A comment on Securing a Postgres Database. Parent comment

Re:Securing a Postgres Database by koolba on Saturday April 03, 2021 @06:24AM (#26679799)
No you can’t. To do the hash you need the per user salt before you start hashing. Which would require reading from the DB.
[ Parent | on HN ]
Re:Securing a Postgres Database by mvolfik on Saturday April 03, 2021 @07:19AM (#26680073)
Then you can retrieve salt, do hash on server, and use the stored procedure to compare. More requests, but a tradeoff for security \o/
[ Parent | on HN ]
Re:Securing a Postgres Database by tpetry on Monday April 05, 2021 @04:46AM (#26696676)
There is no reason you can‘t have a deterministic function which generates a hash for the user.

A simple sha256(lower(email)) is equally secure as a complete random salt, the only requirement on a salt is to be unique.

[ Parent | on HN ]