msaz87 Posted December 4, 2011 Share Posted December 4, 2011 I'm incorporating a dynamic salt into my user system, but I'm not sure how to store the salt itself. The password is hashed and added to the database, but wouldn't you need to store the salt as plain text in the database in order to verify the login later? Also, I've read that using both a dynamic and static salt is good practice. If this is the case, is the static salt simply defined within the PHP? Or is there another method to storing it? Thanks for the help Quote Link to comment https://forums.phpfreaks.com/topic/252417-salting-passwords-how-to-store-the-salt-in-the-db/ Share on other sites More sharing options...
melloorr Posted December 4, 2011 Share Posted December 4, 2011 You should check my thread: http://www.phpfreaks.com/forums/index.php?topic=348885.msg1646220#msg1646220 Quote Link to comment https://forums.phpfreaks.com/topic/252417-salting-passwords-how-to-store-the-salt-in-the-db/#findComment-1294122 Share on other sites More sharing options...
scootstah Posted December 4, 2011 Share Posted December 4, 2011 I'm incorporating a dynamic salt into my user system, but I'm not sure how to store the salt itself. The password is hashed and added to the database, but wouldn't you need to store the salt as plain text in the database in order to verify the login later? You just store the salt in the database. Its only purpose is to make two identical passwords have different hashes. Even if the database is compromised and the salt exposed, its job is still done. Also, I've read that using both a dynamic and static salt is good practice. If this is the case, is the static salt simply defined within the PHP? Or is there another method to storing it? Thanks for the help This is called a pepper. It is just defined in a PHP file somewhere, like in a config file or something. Unless someone actually gains access to the file system, this cannot be discovered. Quote Link to comment https://forums.phpfreaks.com/topic/252417-salting-passwords-how-to-store-the-salt-in-the-db/#findComment-1294125 Share on other sites More sharing options...
msaz87 Posted December 4, 2011 Author Share Posted December 4, 2011 Thanks! The answers definitely clear up my confusion. Quote Link to comment https://forums.phpfreaks.com/topic/252417-salting-passwords-how-to-store-the-salt-in-the-db/#findComment-1294126 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.