关于加盐密码的问题
好的。举例来说，我将密码的盐设置为“hello”。难道有人不能只看源代码并发现盐吗？如果是这样，我该如何隐藏它？谢谢。
Okay. Say for example that i set the salt for a password to "hello." Can't someone just look at the source code and discover the salt? If so, how would I hide it? Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
盐通常以纯文本形式与密码哈希一起存储。它们存在的主要原因是使预计算的彩虹表的使用变得更加困难，并且更难以使用对数据库中的所有密码执行字典攻击。
您还应该为每个密码使用不同随机生成的盐，而不是为整个应用程序使用单一盐。这意味着每个密码必须单独破解。
Salts are are usually stored in plain text alongside the password hash. The main reason they are there is to make it more difficult to use precomputed rainbow tables and more difficult to perform a dictionary attack on all the passwords in the database.
You should also use a different randomly generated salt for each password, rather than a single salt for your entire application. This means that each password must be cracked separately.
首先：安全很难。不要尝试自己做，因为你会把事情搞砸的。使用完善的库来处理用户身份验证。
其次，您似乎误解了盐的用途。盐只是为了防止密码哈希值被轻易逆转 - 每个用户都应该有一个唯一的盐，但最好将盐存储在与哈希密码相同的位置。
First of all: Security is HARD. Don't try and do it yourself, because you will screw it up. Use a well-established library to handle user authentication.
Secondly, you seem to misunderstand the purpose of a salt. The salt is just there to prevent easy reversing of password hashes - there should be a unique salt for each user, but it's fine to store the salt in the same place as the hashed password.
盐在动态时是最好的（比如成员的加入日期）。即使攻击者知道您计算散列的方式，他们也必须暴力破解每个加盐和散列的密码 - 这需要花费大量时间，因为（通常）奖励很少。
话虽这么说，如果攻击者在服务器端查看您的代码，那么您已经遇到了一个更大的问题。
Salts are best when they are dynamic (say the member's join date). Even if the attacker knows the way you compute the hash, they have to brute force each salted and hashed password -- which takes a lot of time, for (in general) little reward.
That being said, if the attacker is looking at your code server-side, you already have a much larger problem.
1）不要对多个帐户使用相同的盐。如果您无法显示源代码并相信您的密码仍然安全，那么您就错了。
2) PKCS #5 v2.1，第 4 节
1) Don't use the same salt for multiple accounts. If you can't show your source-code and trust that your passwords are still secure, you've done it wrong.
2) PKCS #5 v2.1, section 4
希望您的“源代码”运行在网络服务器上，而不是在任何人都可以看到的客户端（javascript）上运行。
Hopefully, your "source code" is running on a web server, and not on the client side (javascript) where anybody can see it.