News for hackers. Stuff that matters.

A comment on Slack was hacked. Parent comment

Re:Slack was hacked by typedweb on Friday March 27, 2015 @10:53PM (#9280302)
The pepper is the key to the encryption, not a hashing algorithm.
[ Parent | on HN ]
Re:Slack was hacked by JimmaDaRustla on Monday March 30, 2015 @10:08AM (#9289561)
Thanks for just ignoring my question - THERE IS NO ENCRYPTION IN THE ORIGINAL ARTICLE, so WHY are you restating that encryption is involved at all?

Straight from the original artical:

  hashed_password = scrypt(password, salt + pepper)
or

  hashed_password = scrypt(scrypt(password, salt),pepper)
Absolutely zero encryption going on here. Therefore, no ability to "decrypt" the pepper result. The pepper IS NOT a key for encryption. Period.
[ Parent | on HN ]