Enough with the Salts: Updates on Secure Password Schemes

Re:Enough with the Salts: Updates on Secure Password Schemes by hueving on Wednesday April 01, 2015 @12:39PM (#9304875)

This is missing something pretty important about salts. They hide the fact that two users have the same password. That's a huge security risk if that correlation is leaked.

Correct me if this is mentioned in the article, but based on several mentions of how salts were effectively useless, I think this was overlooked.

[ Parent | on HN ]

Re:Enough with the Salts: Updates on Secure Password Schemes by homulilly on Wednesday April 01, 2015 @12:46PM (#9304938)

I didn't get the impression the author was saying salts are useless, obviously you still have to use them and bcrypt and scrypt both do. The point is that a lot of programmers naively assume that a salt (or salt+pepper) will make their password storage secure on its own when that isn't really true anymore.

[ Parent | on HN ]