Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I didn't get the impression the author was saying salts are useless, obviously you still have to use them and bcrypt and scrypt both do. The point is that a lot of programmers naively assume that a salt (or salt+pepper) will make their password storage secure on its own when that isn't really true anymore.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: