Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The decryption keys aren't just sitting out in the open so any amount of encryption is better than none.

This is like asking why would we encrypt data on a server since the decryption keys are accessible.

Of course they are, they're needed to decrypt the data. But at least it takes more time to find the keys and that "can" be a deterrent much the way "The Club" is a visual deterrent that can still keep a car from being stolen by demanding too much time to break it.



When you properly encrypt server passwords, they are not supposed to be decrypt-able. Whereas, this is supposed to be a two-way encryption as you need to access the raw data. Ergo, any form of encryption you can do can be easily undone and thus rendering your efforts moot.

http://en.wikipedia.org/wiki/Salt_(cryptography)


I understand one way hashing but what about DB passwords for instance? You need access to plaintext passwords.

This is getting long but the point is plaintext = he worst thing you can do. Even ROT13 is a little better.


Even ROT13 is a little better.

No it's not.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: