
August 28th, 2012, 10:00 AM
|
 |
We're trapped inside a game!
|
|
Join Date: Jul 2008
Location: Maryland
|
|
|
Best practice with storing a salt
I'm building a project for work that has a login mechanism. I'd like to follow good practices as much as possible so I'll be using a per-user salt and hashing it with sha256 at the least. My question is on storing those salts. The easiest would be to store it in our database. At first my concern was that if someone got access to the database they would have access to the salts, but then again, they'd have access to everything else as well in that database. So I guess my question would be, is this a legitimately secure way to store these salts? It's not an overly complex application, it stores pretty basic info, first and last name, email address, maybe street address, no cc information, but I would like to be security-minded and be able to protect our users, just not sure of how far I should go.
Any advice would be great.
__________________
"Those who can make you believe absurdities can make you commit atrocities."
|