News for hackers. Stuff that matters.
Re:Companies must stop using Google Analytics by michaelcampbell on Wednesday July 05, 2023 @08:57AM (#36599780)
That's backwards.

> In cryptography, a pepper is a secret added to an input such as a password during hashing with a cryptographic hash function. This value differs from a salt in that it is not stored alongside a password hash, but rather the pepper is kept separate in some other medium, such as a Hardware Security Module.

https://en.wikipedia.org/wiki/Pepper_(cryptography)

Re:Companies must stop using Google Analytics by jameshart on Wednesday July 05, 2023 @05:21PM (#36607330)
Apparently we understand words differently.

A salt is a unique random value added to each value when hashing. Obviously, such a salt needs to be stored alongside each value because it’s random and unique. If you don’t store it how could you possibly ever figure out what it is?

A pepper is a shared value added to lots of different things before they are hashed. It isn’t unique to each value, so it doesn’t need to be stored alongside them. Although it still needs to be stored somewhere. But hey, you could also store it alongside every value you store. This is a thing sometimes done when you do ‘per user’ pepper, where for example the pepper is itself a a username or something - so your pepper is also in the database alongside the passwords - but that doesn’t make it a salt.

If you are using the same piece of data to season multiple things before hashing, you are using ‘pepper’ not ‘salt’.

Re:Companies must stop using Google Analytics by 3np on Wednesday July 05, 2023 @07:44PM (#36608857)
I think you may be alone in understanding the words "pepper" and "salt" this way.
Re:Companies must stop using Google Analytics by jameshart on Thursday July 06, 2023 @09:08AM (#36615174)
Try reading the rest of the Wikipedia article beyond the first paragraph. Particularly the section on ‘shared-secret pepper’ and ‘unique pepper per user’.