Comments on: A little salt is a good thing

By: Nick

Nick — Thu, 23 Dec 2010 11:33:40 +0000

A beautiful, simple explanation. Thank you.

By: Bill Shaw

Bill Shaw — Thu, 24 Jun 2010 16:52:33 +0000

Thanks Darren. Using usernames probably isn't as good as random numbers (or as you suggest, random strings), since an attacker might already have precomputed hashes for well-known usernames (such as "root"). However, this article was only meant to show how salt works in general. In a real-life implementation, you should use a library that's already been created to do this stuff, like Jasypt if you're doing Java.

By: darren fix

darren fix — Thu, 24 Jun 2010 15:51:32 +0000

Thanks for the article. I do something similar in a database app that I’m writing, except instead of using a really long random number for the salt, I use the unique userid as the salt. So I guess that I have two questions:

1) Does a long random number make a significant improvement to the password security?
2) If #1 is true, wouldn’t it be better to use a long random string instead?

I know that your article was a “100,000 foot overview” and that my questions fall outside of the scope of the article, but I’m afraid that my curiosity has gotten the better of me.

Thanks,
Darren.