Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Perhaps no salt?


Salts don't save you from an attacker who can calculate millions of hashes per second on a GPU.

Using bcrypt/scrypt/Argon2id does.


Salting is incredibly effective. Without salting, the entire power of the attacker can be used against all password hashes at once. With salting, those millions of hashes per second translates to only being able to crack simple passwords, or only the passwords of a few users.


Except in the case of MD5, it's billions, many billions, of hashes per second, which translates to cracking lots of users' passwords.


Salt is not intended to save you, just to make unhashing the next user's password just as much work as the one you just cracked.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: