Re:Feds tell web firms to turn over user passwords
by Xylakant on Friday July 26, 2013 @06:21AM
(#6107454)
Good encryption systems assume that the algorithm is known and still are secure in face of that requirement. So if publishing the method makes your system insecure then it's already insecure by design. Security through obscurity is not a viable approach.
[ Parent
| on HN ]
Re:Feds tell web firms to turn over user passwords
by eToThePiIPower on Monday July 29, 2013 @11:49AM
(#6121826)
Yes, good encryption/hashing assumes the algorithm is known, but we're also talking about the giving away the salt. The salt in a secure hash plays an analogous role to the secret key in an encryption cipher; both are assumed unknown by an attacker.