Hacker News new | ask | show | jobs
by philippta 505 days ago
What's the reason behind bcrypt(userId + username + password) rather than just bcrypt(password) ?
2 comments

What if two different users have the same password?
Bcrypt is salted[1], so that shouldn't matter?

[1]: https://en.wikipedia.org/wiki/Bcrypt#Description

Are you sure?

bcrypt stores the salt and retrieves it for comparison - otherwise you wouldn't be able to generate a matching hash.

Consider the case where a user has a very long username and sets their password to their userId + username + password thus recreating the scenario which lead to the incident.

That was not my point. My point was there wouldn't be a hash collision just by two users with the same password due to the salting.
There's no hash collision here, just two different hashes, each with its own salt, matching the same original phrase.

If you use only the password to generate the cache key, then this password will match regardless of salt, so users with the same password will generate a cache key matching that password.

Yes, that's what I pointed out when you suggested there would be a problem with two different users having the same password.
Why would that matter though?
rainbow tables I guess