News for hackers. Stuff that matters.

A comment on ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users. Parent comment

Re:ParkMobile Breach Exposes License Plate Data, Mobile Numb... by dreadlordbone on Wednesday April 21, 2021 @11:13PM (#26898329)
My guess it they have a static salt for all passwords in code somewhere (newbie mistake I made years ago).
[ Parent | on HN ]
Re:ParkMobile Breach Exposes License Plate Data, Mobile Numb... by jpalomaki on Thursday April 22, 2021 @01:38AM (#26899123)
Static salt is called pepper [1]. It's not a bad idea - but it would be better used with the regular salt.

Some people don't seem to like the idea, but I think it adds an easy additional layer of protection. At least in the past many of the password leaks seemed to be due SQL injections and only leaking the database content. Pepper stored in the code would have protected the passwords.

https://en.wikipedia.org/wiki/Pepper_(cryptography)

[ Parent | on HN ]