Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Every secure password storage scheme is randomized. None of them need explicit salts; salting is built in. If you have to provide the salt, you are doing something wrong.


If you want to advocate the usage of pre-built password libraries, go right ahead. But please find a way of promoting it without adding confusion about the use of salts.


If you are adding your own salts, you are doing it wrong.

There is no secure password storage scheme that doesn't randomize.

What you are saying is morally equivalent to "if you want to use a preexisting block cipher that's fine, but don't confuse people about the need to use nonlinear substitutions". No, if you are designing your own s-boxes you are doomed. Use AES.

This isn't worth arguing about except that you strike me as one of these people that think they're doing it right because they add salts to their hashes. No, you aren't.


Let me repeat: salt is built in.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: