Salt and hashing, why not use username?

后端 未结 3 1600
南笙
南笙 2021-02-06 22:20

I must confess to being largely ignorant on most of the high-tech security issues relevant for web applications, but there is one thing I at least thought I could ask because it

3条回答
  •  伪装坚强ぢ
    2021-02-06 22:51

    Because user names have lower entropy than a random salt, so they spread your hashes around less than a proper salt does.

    Not that the example on that page is very spectacular anyway. I always just generate a GUID and use that.

    I suspect it's all down in the noise as far as real-life security is concern, and even quite small amounts of per-user salt make a big difference to security, with very small improvements as the salt gets more complex.

提交回复
热议问题