Hacker News Reader

Comment by lallysingh | Hacker News Reader

This sound about right?

Add a column named 'salt' to USER, then the PASS column=PASSWORD(salt+'text');

Paul Buchheit has a blog post on this. The summary of his blog post is this: "Using a salted-hash such as MD5 or SHA-1 isn't much better. Use bcrypt."

http://paulbuchheit.blogspot.com/2007/09/quick-read-this-if-...

PASS column = MD5(MD5(plaintext_pass) + salt)

SALT column = salt

Is the way used in most distributable web applications.

I think what you actually want is:

PASS column = HMAC(plaintext_pass, salt)

I might be wrong? As I understand it there are issues with MD5(MD5(password) + salt) that HMAC avoids. I'm still not 100% sure I understand the difference, but I think that is what the wikipedia article on HMAC is saying: http://en.wikipedia.org/wiki/HMAC#Design_principles

HMAC is mostly useful when you want to verify that some text hasn't been altered. The client sends message + HMAC(message, secret) and then the server (which also knows the secret) can verify that no-one has changed the message.

Dunno if it helps anything when it comes to salting. Anyone else who knows?

I'm a fan of RIPEMD-160 with salts, it is my default hashing algorithm that i use in my apps. MD5 sits alongside CRC checksums for me when I think about security. For symmetric encryption, I like AES.

In this case though, the choice of hashing algorithm is at least as important as the salt.

If the attacker was motivated to have Jeff Atwood's password, he could have grabbed the salted hash and used a password cracker against it. We're talking a single password for a high profile user, so why not spend a few hours of CPU time on it?

Only an adequate password hashing algorithm (ie, SLOW) would have really prevented this.

Right idea. However, if you're using MySQL, the docs recommend against that: http://dev.mysql.com/doc/refman/5.1/en/encryption-functions....

Use a different hashing function, probably bcrypt. (Note to self: go back and check some of my old code that did/does exactly what you describe...doh!)

Reply on news.ycombinator.com