Re:Project Euler Returns
by stouset on Saturday August 16, 2014 @03:21AM
(#8185620)
This thread is dishearteningly full of cargo-culted cryptography. You would think HN would do better. A global salt is not a thing. It's a misapplication of a cryptographic component. The appropriate tool when you think you need something like this is an HMAC and a secret HMAC key.
[ Parent
| on HN ]
Once again we are talking about having an email retrieval function while not storing the email address in plaintext. A "global salt" or "pepper" (as we are apparently calling it now) just prevents enormous pre-generated rainbow tables but admittedly in today's gpu dominated cracking environment it probably doesn't get you much.
Personally I think not having a password retrieval function while simultaneously forcing all of your users to reset their password is a pretty user unfriendly tactic for the protection of an ostensibly public piece of information.
Re:Project Euler Returns
by owenversteeg on Saturday August 16, 2014 @05:29AM
(#8185777)
I wasn't saying it was a good idea, just that the majority of people using one refer to it as a pepper.