Re: virtue of salted passwords

From: yawnmoth (terra1024_at_yahoo.com)
Date: 11/21/05 

Date: 21 Nov 2005 14:02:27 -0800

+Alan Hicks+ wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> <snip>
> Not necessarily. Password hashes can be retrieved in any number of
> ways. There are no garauntees that an attacker who can find a password
> hash would also retrieve the salt at the same time.

Any ideas as to how to make it harder to retrieve salts for web
applications? One idea would be to have two seperate databases with
different passwords. One database would contain the salt and the other
would contain the hash. Although this would make it that much harder
for both to be revealed via sql injection, it doesn't really seem all
that feasable a solution. Another idea would be to store salts using
text files and hashes in databases...

Relevant Pages

  • Re: Best way to encrypt password in database.
    ... Yep, that's the traditional way to do it, hash the password every logon ... If you password hashes ... Oh and BTW, never use MD5 for anything security related, it is broken ... Any of these one way hashes still needs a salt combined with it. ...
    (comp.lang.php)
  • Re: Best way to encrypt password in database.
    ... Yep, that's the traditional way to do it, hash the password every logon ... If you password hashes ... Oh and BTW, never use MD5 for anything security related, it is broken ... Any of these one way hashes still needs a salt combined with it. ...
    (comp.lang.php)
  • Re: Best way to encrypt password in database.
    ... Yep, that's the traditional way to do it, hash the password every logon ... If you password hashes ... The fix is to add a salt to thwart the rainbow tables and a have the ... Oh and BTW, never use MD5 for anything security related, it is broken ...
    (comp.lang.php)
  • Re: Is this secure
    ... What I do in my business layer I get the salt, then I use my custom classes ... to hash the passed in password then send the Hash to a Stored Proc to ... Both the hashed password and salt are stored in the database. ... but then i'd need the salt to create a saltedhash to ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Best way to encrypt password in database.
    ... Yep, that's the traditional way to do it, hash the password every logon ... If you password hashes ... MD5 is not broken. ... Any of these one way hashes still needs a salt combined with it. ...
    (comp.lang.php)