grishka / Smithereen

Federated, ActivityPub-compatible social network server with friends, walls, and groups.
The Unlicense
393 stars 31 forks source link

Use salt for storing passwords in the database #75

Closed broadwaylamb closed 3 months ago

broadwaylamb commented 3 months ago

This is a much more secure way to store users' passwords. For example, if we are not using salt and two different users happen to have the same password, the hashes stored in the DB will also be the same, which is something that an attacker with the access to the DB can use.

Also, if the user uses a not strong enough a password, the attacker with the access to the DB may be able to recover the password using rainbow tables.

Using salt will help prevent those kinds of attacks.

More info on that: http://www.aspheute.com/english/20040105.asp