jperezduerto.info
Security in depth · Unit 19 · Lesson 4 of 8
Store verifiers, not reusable passwords
Separate salt, password-hashing cost, and account recovery when reviewing stored credentials.
Helpful before thisInitial access and credentials
After this lesson you can
- Explain why a supplied salted fast-hash design still needs a password-storage correction.
One idea. One situation. One reasoned decision.
How it works
A password verifier should allow a service to check a password without storing the original in recoverable form. Purpose-built password hashing uses a salt and an appropriate configurable work factor. A salt need not be secret and does not replace a suitable hashing function. Password reset should establish new access through a controlled process rather than emailing someone their existing password.
Read the supplied record
A fictional application accepts passwords. The owner requires a suitable password-hashing scheme and controlled reset rather than disclosure of the old password.
| Design record | What is supplied |
|---|---|
| A | Distinct random salt per account; one fast general-purpose hash |
| B | Password-hashing algorithm; salt and cost parameters recorded, values not provided |
| Recovery | Support proposes displaying the existing password |
A’s salts make account inputs distinct; they do not supply the configurable computational work needed to make individual guesses more expensive. Do not call A adequate from the salt field alone. B has the right kinds of configuration fields, but reviewing the selected algorithm, parameter values, and resource constraints remains necessary.
The recovery proposal also conflicts with the requirement. It does not prove how the current database stores passwords: it is a proposed feature, not an observed retrieval. Recommend a controlled reset design and ask for the missing B configuration. This packet contains no passwords, hash values, or password-guessing exercise.
The key distinction: Salt and computational cost serve distinct purposes.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
What does the supplied salt information establish?
Show the answer
Correct answer: A separates accounts’ hash inputs, but still lacks the specified password-hashing work; B requires parameter review. Salt and configurable cost serve different purposes. An algorithm label alone also does not establish B’s configuration.
Try it
- WriteWrite a review with one supported weakness in A, two facts needed to assess B, and a recovery behavior that should replace revealing an old password.