Hacker News Reader

>if they use the same salt for each password then the article is correct(ish).

Wouldn't it be a pepper then?

https://en.wikipedia.org/wiki/Pepper_(cryptography)

edit: nvm, it seems the main difference is a pepper being secret.

Yep - a pepper is an app-wide value that forces an attacker to get both a configuration value (from the source, or env vars) and also the hashes of the passwords (a db dump). Just another incremental thing for an attacker to overcome that is cheap & easy to implement.

Salts must be unique per password as far as I know? Otherwise they don't do their main goal which is to make every guess useful against only one hash. (ie: guess 'hunter2', check if any user had hunter2 as a password, but salted, you'd only be able to guess if cschneid had hunter2 since you'd be hashing hunter2-sssssaaaaallllltttt).

Yeah, I was trying to imply a correctish for a general audience.

If right or wrong is a spectrum.

Reply on news.ycombinator.com