News for hackers. Stuff that matters.
Re:LivingSocial Hacked – 50 Million Customers Affected by pindi on Friday April 26, 2013 @07:59PM (#5616197)
A similar method is a "pepper", a form of salt common to all users and stored in the application configuration, allowing the passwords to resist attack even if the hash and user-specific salt are lost. The reason it's not often used is that the assumption is that if your database is compromised, any other commonly-used secret keys on the server will be too. It can be useful for defense in depth, though.
Re:LivingSocial Hacked – 50 Million Customers Affected by marshray on Saturday April 27, 2013 @10:36PM (#5619933)
Serious question: How is "pepper" any different than encrypting a traditional salted hash using a symmetric cipher as if it were any other kind of data?