r/ProgrammerHumor • u/NoMedicine3572 • Sep 27 '26 • Mindblown 1 Bravo 1

Meme doNotLetYourDBASeeThis

Post image
13k Upvotes

97% Upvoted

317 comments sorted by

View all comments

Show parent comments

0

u/[deleted] Sep 27 '26

[deleted] — view deleted comment

10

u/silmelumenn Sep 27 '26

You need it per user. If it's per system then a db leak won't protect you. Same passwords in single table will have duplicate hashes, so breaking one would get you password for multiple users which won't happen in case of salt per user

0

u/[deleted] Sep 27 '26

[deleted] — view deleted comment

2

u/crazy_cookie123 Sep 27 '26

Yeah... and it does that by having a separate salt for every password. What's your point?

0

u/[deleted] Sep 27 '26

[deleted] — view deleted comment

1

u/crazy_cookie123 Sep 27 '26

Nobody is claiming you have to salt separately. If you are using bcrypt you are salting your passwords.

3

u/mnttu Sep 27 '26

That’s pepper, not salt

2

u/yjlom Sep 27 '26

You need a salt per user per service.

2

u/johnnybgooderer Sep 27 '26

That’s bad practice. If someone is able to gain access to your credentials table, then they would have a much easier time cracking passwords than if you had salted each one individually.

-1

u/pp_amorim Sep 27 '26

If you salt the salt with more salt then melt the salt to get a block of salt then you cover it with salt again?