Hacker News Reader

What about using a unique salt for each user. For example, if you use the user's login name. Then, the hacker would have to make a rainbow table for each user, in essence.

I think bcrypt is probably still more secure? Or maybe the best would be to combine both.

View on HN

Are you saying there are salting systems that don't use a unique salt for each user?

Yeah - normally crappy hand rolled PHP ones.

Bcrypt would be more secure.

The problem is that by using a unique salt per user, you can't simply create one salted hash and use it on every user hash simultaneously, however you can still check one password each hash you generate. Bcrypt/scrypt are more secure as it requires much more effort to check each password.

Right; see "Salt will not help you" here: http://codahale.com/how-to-safely-store-a-password/

The standard hash algorithms are designed to be fast executing. They're built for determining uniqueness quickly, not for securing passwords.

Reply on news.ycombinator.com