News for hackers. Stuff that matters.
Re:Project Euler Returns by Arnor on Friday August 15, 2014 @04:42PM (#8184075)
I had a visceral reaction to "global salt" (I've always heard this called: "pepper") because it's so insecure for passwords, but I guess it's not as bad for email addresses. In the case of passwords, we find that a global salt is fairly ineffective because too many people use common (stupid) passwords like "password." If 10% of the hashes are the same, you can probably figure out what that hash means pretty quickly. We don't have this overlap problem with emails so it's less scary.

Still, simply storing the create time or a randomly generated salt right on the user table is more secure than using a global salt.

Re:Project Euler Returns by stouset on Saturday August 16, 2014 @03:31AM (#8185640)
A global salt is not a thing. Not is a pepper. The actual cryptographic construct is an HMAC and secret HMAC key.
Re:Project Euler Returns by runamok on Friday August 15, 2014 @05:12PM (#8184249)
Right but in this case you would essentially have to use every salt from every user to hash the submitted email and say "aha user 123,456 has a salt and hashed email which matches the submitted email of [email protected]" which is why I suggested method 2. I am user "Arnor" and my email is "[email protected]". Ok, your salt is #@$%@#$%DGDFfdgdawer.

If your hashing algorithm is appropriately "expensive" the scan all user salts would not work.