Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I didn't get this either. The page http://pajhome.org.uk/crypt/md5/auth.html is a good explanation.

Regarding the salt, the page says:

Using a different salt for each user presents an issue: the salt isn't known until the user name is known. For a web application, this would require a two-stage login form - one form asking for the user name and a second asking for the password. Such an arrangement would be quite unfriendly towards users. Fortunately, there is a simple alternative. The salt is generated by concatonating the user name with a "system salt". The system salt is the same for all users on one system.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: