Skip to main content
Information Security

Return to Question

Post Closed as "Duplicate" by Gilles 'SO- stop being evil', RoraΖ, CommunityBot, Xander, paj28
Tweeted twitter.com/#!/StackSecurity/status/641713419012472833
added 1 character in body
Source Link
user45139
user45139

I'm programmingdeveloping an authentication service.

I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks.

I just had the idea of adding a second salt, inside the code, not existing in the DB, so if the database is leaked (but not the code), even weak passwords are not vulnerable to brutforcebrute-force.

I seems to be a good idea to me, but as I'm not an expert I'd like to have the confirmation of people who are good in information security.

I'm programming an authentication service.

I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks.

I just had the idea of adding a second salt, inside the code, not existing in the DB, so if the database is leaked (but not the code), even weak passwords are not vulnerable to brutforce.

I seems to be a good idea to me, but as I'm not an expert I'd like to have the confirmation of people who are good in information security.

I'm developing an authentication service.

I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks.

I just had the idea of adding a second salt, inside the code, not existing in the DB, so if the database is leaked (but not the code), even weak passwords are not vulnerable to brute-force.

I seems to be a good idea to me, but as I'm not an expert I'd like to have the confirmation of people who are good in information security.

Source Link
IggY
IggY
  • 378
  • 2
  • 7

Password hashing : Using 2 salts

I'm programming an authentication service.

I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks.

I just had the idea of adding a second salt, inside the code, not existing in the DB, so if the database is leaked (but not the code), even weak passwords are not vulnerable to brutforce.

I seems to be a good idea to me, but as I'm not an expert I'd like to have the confirmation of people who are good in information security.