Hacker News Reader

Your pepper is always static, and your salt becomes static. Wouldn't that essentially be peppered even without the pepper?

I don't see any value of a pepper. It doesn't actually add any protection.

View on HN

No, because the static salt will be stored in the database alongside the passwords. The pepper would be compiled and live in the application layer. The value is minimal but so is the cost.

If it's static salt, it breaks the use of salt. Salt was designed such that a rainbow table cannot crack two similar passwords based on hash, exactly what a static salt would facilitate.

If not stored in the database, it ensures that a database dump alone isn’t enough to recover even a single password. It certainly doesn’t have the level of impact that salting passwords or using a cpu-hard and memory-hard hash does, but it’s certainly something.

Modern password hashes like argon2 include this feature natively.

Reply on news.ycombinator.com