Coding Horror: You're Probably Storing Passwords Incorrectly

Re:Coding Horror: You're Probably Storing Passwords Incorrectly by thomasptacek on Monday September 17, 2007 @12:02PM (#55734)

The salt is public. If you have the password table, you have the salt. The attacker doesn't have to guess the salt with an incremental password cracker (read: almost any password cracker).

The mistake you're making is your misuse of the word "key". Larger keys are more secure. A salt is a nonce, not a key.

Can I say again that people shouldn't be rolling their own password scheme? This is a problem that has been well-addressed for decades, but the majority of new applications still ship with code that is inferior to public domain code from 1976.

[ Parent | on HN ]

[deleted]

Re:Coding Horror: You're Probably Storing Passwords Incorrectly by thomasptacek on Monday September 17, 2007 @12:22PM (#55747)

Your hash function needs to be slow, so that incremental cracking is infeasable. This is much more important than the length of your salt. No offense, but you should read the articles you comment on.

[ Parent | on HN ]

[deleted]

Re:Coding Horror: You're Probably Storing Passwords Incorrectly by thomasptacek on Monday September 17, 2007 @12:39PM (#55758)

Seriously, all three of the articles you're implicitly commenting on answer this question directly.

[ Parent | on HN ]