News for hackers. Stuff that matters.

A comment on LivingSocial Hacked – 50 Million Customers Affected. Parent comment

Re:LivingSocial Hacked – 50 Million Customers Affected by ukd1 on Friday April 26, 2013 @05:46PM (#5615697)
You shouldn't use SHA: it's not designed for hashing passwords. Checkout bcrypt / scrypt and read: http://crackstation.net/hashing-security.htm
[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by cschneid on Friday April 26, 2013 @06:08PM (#5615783)
That doesn't mean an additional secret stored on the server is a bad idea either way.

I've heard it referred to as a pepper (to go along with salt) and is in the application code.

bcrypt(password, salt, pepper) => hash. So even if they grab the db with the salt, the effective password to crack turns into 'password3jkl453jklgfuja9oph4mn" instead of just 'password'. Impossible.

And if they do get your site's code, you're back to a strong hashing algo and a salt.

[ Parent | on HN ]