Hi, what is unsalted hash in postgres. ?

Question

PostgreSQL (English)

Rajini J

Hi, what is unsalted hash in postgres. ?

#programming #russian

0

16.10.2023

1 ответов

4 просмотра

Kirk · Accepted Answer

well a SALTED hash, for MD5() for example is when you ADD Strings/text to the value, to ensure dictionary attacks on weak passwords don't work, and no 2 user passwords (even if the same) result in the same hash value. MD5 is weak, use SHA-256... But using MD5() here: Unsalted = SELECT MD5($1); — where $1 is user's password Salted = SELECT MD5( concat('Some RaNdOm SaLt 123', $2,'+', $1,'... Ending Salt'); — Where $2 is user_ID, $1 is pwd you should be able to realize how much BETTER some salting is. It means the attacker would either need to your salting/string setup... Or their brute force attacks on your passwords is futile. FWIW, salting can be complex, and done 1/2 in the client as above, and 1/2 in a DB server plpgsql function. So that NEITHER developer has access to the proper salting technique! Salted = SELECT MD5( concat('Some RaNdOm SaLt 123', $2,'+', DB_PWD_SALT($1),'... Ending Salt'); — Where $2 is user_ID, $1 is pwd Some call it overkill... I call it sleeping WELL At night. Never include "Email" with the salt, if the user can change their email address... (then it breaks their salted password in my second example). One must think ahead. (I used "ID" specifically, which should NEVER change, but PK would have been a better descriptor). HTH...

169 похожих чатов

Hi, what is unsalted hash in postgres. ?

1 ответов

Похожие вопросы