Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What about encrypting the hash of password+salt and keeping the key really safe? Would that be a better strategy?


Cryptographically, encrypting doesn't actually add any more security so... no point imo

edit: but infosec isn't completely equal to cryptography, so some deterrence like that will prevent some attacks. But it's like adding a real beefy padlock on your door (the hashing), and then putting a piece of tape to keep your door shut. Or putting a piece of tape over the keyhole of your padlock.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: