Beefy Boxes and Bandwidth Generously Provided by pair Networks
Do you know where your variables are?

Re^2: Passwords, hashes, and salt

by ikegami (Pope)
on Jun 24, 2005 at 18:34 UTC ( #469787=note: print w/replies, xml ) Need Help??

in reply to Re: Passwords, hashes, and salt
in thread Passwords, hashes, and salt

Adding salt does two things:

1) It makes it harder to brute force the password list.

2) If person A knows his password hashes to the same value as person B's -- some websites stupidly publish users that had the same password hash -- person A could login as person B using their own password without even knowing person B's password. Adding salt would create different hashes (even for the same password), eliminating this problem.

usually based on some input from the user record or the password itself

Salts are usually random. Ideally, each user has a different salt. They must definitely NOT be based on the password since the salt must be known. Basing it on the password would leak info about the password.

Crypt::PasswdMD5 creates a salt for you if you don't specify one, according to the documentation.

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://469787]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others lurking in the Monastery: (4)
As of 2020-02-27 02:21 GMT
Find Nodes?
    Voting Booth?
    What numbers are you going to focus on primarily in 2020?

    Results (118 votes). Check out past polls.