joedaltonwallas
Joined 16 years ago
Karma
2
Submissions
4
Member since
Nov 17
Recent submissions
Comment · 16 years ago
Comment · 16 years ago
please correct me if I'm wrong: you are not storing passwords, you are storing hashes & salts. One different long random salt for each password.
In my database I store hashes obtained with Blowfish:
http://derekslager.com/blog/posts/2007/10/bcrypt-dotnet-stro...
How many tries would you have to do to guess it? And for the other passwords you have to start all over again.
Comment · 16 years ago
Why people are so frightend of storing the salt & hash of the user password? May be I am mistaken but if the salt is unique for each hash it is almost imposible to recover the original password. Of course you must use a well proven encription library but it is trivial. Am I missing something?
I think that storing them is not more difficult, it is more convenient and secure (of course this is relative). But maybe I am missing something about the security of this scheme.