<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Am 17.03.2013 01:46, schrieb Jeremy
Baron:<br>
</div>
<blockquote
cite="mid:CAE-2OCaaGH9zmPTKcL_wADVvu_-5JrE+CSiMQ=yL+=WWftT9Sg@mail.gmail.com"
type="cite">
<p dir="ltr">On Mar 16, 2013 7:18 PM, "Thomas Gries" <<a
moz-do-not-send="true" href="mailto:mail@tgries.de">mail@tgries.de</a>>
wrote:<br>
> Why not salt-per-user ?</p>
<p dir="ltr">I'm not sure what you mean.</p>
</blockquote>
<br>
It is much safer to add have different salt per user. <br>
<a class="moz-txt-link-freetext" href="http://crackstation.net/hashing-security.htm">http://crackstation.net/hashing-security.htm</a><br>
<br>
section The RIGHT Way: How to Hash Properly<br>
...<br>
The salt needs to be unique per-user per-password. Every time a user
creates an account or
changes their password, the password should be hashed using a new
random salt. Never reuse a salt.
The salt also needs to be long, so that there are many possible
salts. As a rule of thumb, make your
salt is at least as long as the hash function's output. The salt
should be stored in the user
account table alongside the hash. <br>
<br>
</body>
</html>