Reply to thread

Message: <blockquote data-quote="Edward Kenway" data-source="post: 27666619" data-attributes="member: 522682">Who on earth use the same salt for every password? if that's the case then why would they store the salt with hash? It'll be rows upon rows of same value wouldn't it??Well the problem with using HSM is two fold. 1) Encrypting passwords is unnecessary and unethical. Encryption is used when you intend to get the original value later. With a password that's not needed and it's wrong to know your users password. Encryption is less secure because it has to facilitate reversing whatever it does. Hashes are not. This is what OWASP has to say about the matter. <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html" target="_blank">https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html</a>2) More you access your HSM, larger the attack surface is. if you store passwords in HSM that means you need to access it every time user logs in. Unnecessary action that can jeopardise the security of items that you actually need to store in the HSM.</blockquote>

Top Bottom