114
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 30 May 2025
114 points (98.3% liked)
privacy
4487 readers
127 users here now
Big tech and governments are monitoring and recording your eating activities. c/Privacy provides tips and tricks to protect your privacy against global surveillance.
Partners:
- community.nicfab.it/c/privacy
founded 3 years ago
MODERATORS
It's a massive red flag. It implies that they are actually storing the password instead of a (preferably salted) hash and that they have no idea what good security practices are. Storing a hash leads to same size strings, no matter the length on the password.
And there's no reason a database can't store a very long hash as well. Storage is cheap for this kind of thing.
That's why I only store and compare the first 8 characters.
Why not store the whole thing?
I'm joking of course, but the reason would be the database column is 8 characters.
If only there was a SQL command that could alter an existing table...
They shouldn't be using salted hashes since a decade or more. Best is to use a memory hard password hash function like argon
Can you expand on this? My experience with Argon is looking up a Wikipedia page in response to this comment, but it looks like it uses a salt as an input?
Its a password specific function. Its also memory hard.
As oposed to generation a salt and passing that with the password through sha256 or something, which is bad practice