Re:Plex Security Incident
by solid_fuel on Monday September 08, 2025 @08:39PM
(#45176024)
Maybe this is what you're saying, I'm not sure - my understanding was that the salt prevents reused passwords from resulting in the same hash. So, if I use 'password' and you use 'password' the salt+hash will be different. That way attackers can't just hash all the common passwords once and immediately associate them with different accounts.
[ Parent
| on HN ]
Re:Plex Security Incident
by OkayPhysicist on Tuesday September 09, 2025 @11:23AM
(#45183248)
Yeah, exactly. Commonly, the salts are stored right next to the hashes in the DB, because they serve their purpose even if the attacker knows what the salts are. By using a different salt for every password, the attacker needs execute a full "guess, hash, compare, repeat" attack on each user, as opposed to "guess, hash, compare against all user passwords, repeat" on the entire database.