Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

12
  • 1
    Salts are not designed to be secret, and exposing them is not equivalent to storing unsalted password hashes. Commented Mar 14, 2016 at 16:16
  • You are right, but it makes it easier. Commented Mar 14, 2016 at 16:21
  • While your statement about salt is incorrect, your PFS statement is insightful. Commented Mar 14, 2016 at 16:21
  • I will try to fix that. Commented Mar 14, 2016 at 16:22
  • @honze - the whole point of salt is to provide protection once the password hash (with the salt) is stolen. If salt doesn't provide protection here, then the password hash was not complex enough (or the password was a very common one, in which case an online attack has a chance of success). Commented Mar 14, 2016 at 16:23