Skip to main content
Information Security

Return to Answer

added 15 characters in body
Source Link
Benoit Esnard
Benoit Esnard
  • 14.7k
  • 7
  • 71
  • 70

A bcrypt salt must be 128-bit long, that's why using email addresses can't work, since their length aren't fixed.

Moreover, salts used for password hashing must be unique. An email address, even if marked as unique in your database, could also be used as a salt in another database on another website. That's why you should generate one randomly.

Since salts aren't secret, you could fetch the salt associated with the email address the user wants to login with (via AJAX), perform the first bcrypt calculation, and send the result to the server.

But that's not a good idea from a security perspective. Please see [https://security.stackexchange.com/a/143871/76718)this question to understand why hashing the password client-side isn't needed.

A bcrypt salt must be 128-bit long, that's why using email addresses can't work, since their length aren't fixed.

Moreover, salts used for password hashing must be unique. An email address, even if marked as unique in your database, could also be used as a salt in another database on another website. That's why you should generate one randomly.

Since salts aren't secret, you could fetch the salt associated with the email address the user wants to login with (via AJAX), perform the first bcrypt calculation, and send the result to the server.

But that's not a good idea from a security perspective. Please see [https://security.stackexchange.com/a/143871/76718) to understand why hashing the password client-side isn't needed.

A bcrypt salt must be 128-bit long, that's why using email addresses can't work, since their length aren't fixed.

Moreover, salts used for password hashing must be unique. An email address, even if marked as unique in your database, could also be used as a salt in another database on another website. That's why you should generate one randomly.

Since salts aren't secret, you could fetch the salt associated with the email address the user wants to login with (via AJAX), perform the first bcrypt calculation, and send the result to the server.

But that's not a good idea from a security perspective. Please see this question to understand why hashing the password client-side isn't needed.

Source Link
Benoit Esnard
Benoit Esnard
  • 14.7k
  • 7
  • 71
  • 70

A bcrypt salt must be 128-bit long, that's why using email addresses can't work, since their length aren't fixed.

Moreover, salts used for password hashing must be unique. An email address, even if marked as unique in your database, could also be used as a salt in another database on another website. That's why you should generate one randomly.

Since salts aren't secret, you could fetch the salt associated with the email address the user wants to login with (via AJAX), perform the first bcrypt calculation, and send the result to the server.

But that's not a good idea from a security perspective. Please see [https://security.stackexchange.com/a/143871/76718) to understand why hashing the password client-side isn't needed.