|
|
|
|
|
by stouset
4840 days ago
|
|
There is zero requirement that salts be kept secret in the event of a password database breach. Salts are to prevent users with identical passwords from having identical password hashes, thereby defeating rainbow table attacks (and other attacks involving attackers being able to reuse work from other accounts). Your approach offers effectively zero additional security; it is trying to add "features" to salting that don't work towards their actual purpose. Edit: If you want to have something site-wide that an attacker wouldn't have while decrypting an offline password database, the thing you're looking for is an encryption key. |
|