Hacker News new | past | comments | ask | show | jobs | submit login

Salting is no replacement for strong passwords, this would work against most any salting scheme.



Not if part of the information is kept in code only, like iteration count on bcrypt


There is a chance that if your DB is compromised, your code is as well. Additionally, what if you want to change your work factor, how would you handle doing that? If you upgrade your server environment and then all of a sudden realize that your hashing algorithm only take .1 seconds, when it used to take .5 you might want to change it.


While that may slow down an attacker in some circumstances, a sufficiently secure password scheme will still be secure with total knowledge of the system available to the attacker. See also: security through obscurity.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: