News for hackers. Stuff that matters.

A comment on LivingSocial Hacked – 50 Million Customers Affected. Parent comment

Re:LivingSocial Hacked – 50 Million Customers Affected by wisty on Saturday April 27, 2013 @07:46AM (#5617503)
Yes, it's a great idea.

It's called "salting" the password. Everyone does it. It works really well.

Of course, if they can steal your salt (from your source, or a config file) then you lose.

[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by JshWright on Saturday April 27, 2013 @08:54AM (#5617632)
What's the OP is talking about is commonly called a 'pepper'. Some fixed secret in your application code that impacts the generated hash.

Since salts are random, and unique per password, you shouldn't be storing them in a config file.

[ Parent | on HN ]