Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

2
  • 5
    Global salt = pepper Commented Oct 8, 2013 at 6:32
  • 1
    Side note, I believe you'll find that companies doing detection of credit card fraud do store the numbers. PCI allows them to do that as long as they're rendered unreadable by encryption or an equivalent. And they need the original numbers to handle things like account updates - when you get a replacement card, a notification goes out that old card X equals new card Y. Rather than playing with games to weaken and strengthen hashes, maybe you should just encrypt the "compare" versions and be really careful the key can't be compromised at the same time as the database. Commented Oct 10, 2013 at 3:30