News for hackers. Stuff that matters.

A comment on League of Legends database compromised, passwords hashed without salt. Parent comment

Re:League of Legends database compromised, passwords hashed ... by drivebyacct2 on Saturday June 09, 2012 @02:31AM (#4087426)
Yes, as long as you use some salt data that is unique per user (timestamp, random number/guid/whatever) (you have to store that obviously), then it's fine. The problem is acting as if a site-wide salt is an ok-thing. It's not.
[ Parent | on HN ]
Re:League of Legends database compromised, passwords hashed ... by chc on Saturday June 09, 2012 @03:43AM (#4087547)
Incidentally, as the guy who started this whole thing, I'd just like to note that I actuslly agree with this. When I said they were "OK" or whatever, I meant it in the sense of "I guess it's good they're doing something," not like I'd recommend it. Please nobody get that idea.
[ Parent | on HN ]