<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Oh, he thinks this is about
passwords... Thomas, please see
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<a href="http://saltstack.com/">http://saltstack.com</a><br>
<br>
<br>
Alex Monk<br>
<br>
On 17/03/13 01:37, Thomas Gries wrote:<br>
</div>
<blockquote cite="mid:51451E63.4080509@tgries.de" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<div class="moz-cite-prefix">Am 17.03.2013 01:46, schrieb Jeremy
Baron:<br>
</div>
<blockquote
cite="mid:CAE-2OCaaGH9zmPTKcL_wADVvu_-5JrE+CSiMQ=yL+=WWftT9Sg@mail.gmail.com"
type="cite">
<p dir="ltr">On Mar 16, 2013 7:18 PM, "Thomas Gries" <<a
moz-do-not-send="true" href="mailto:mail@tgries.de">mail@tgries.de</a>>
wrote:<br>
> Why not salt-per-user ?</p>
<p dir="ltr">I'm not sure what you mean.</p>
</blockquote>
<br>
It is much safer to add have different salt per user. <br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://crackstation.net/hashing-security.htm">http://crackstation.net/hashing-security.htm</a><br>
<br>
section The RIGHT Way: How to Hash Properly<br>
...<br>
The salt needs to be unique per-user per-password. Every time a
user creates an account or changes their password, the password
should be hashed using a new random salt. Never reuse a salt. The
salt also needs to be long, so that there are many possible salts.
As a rule of thumb, make your salt is at least as long as the hash
function's output. The salt should be stored in the user account
table alongside the hash. <br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Labs-l mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Labs-l@lists.wikimedia.org">Labs-l@lists.wikimedia.org</a>
<a class="moz-txt-link-freetext" href="https://lists.wikimedia.org/mailman/listinfo/labs-l">https://lists.wikimedia.org/mailman/listinfo/labs-l</a>
</pre>
</blockquote>
<br>
</body>
</html>