Storing salt in code instead of database Storing salt in code instead of database asp.net asp.net

Storing salt in code instead of database


The value of a salt lies in it being different for each user. You also need to be able to retrieve this non-unique value when you're re-creating the hashed value for comparison purposes.

If you store a single salt value that you use for every password, then you massively reduce the value of having a salt in the first place.


The purpose of a salt is to require the regeneration of a rainbow table per password. If you use a single salt, the hacker/cracker only has to regenerate the rainbow table once and he has all your passwords. But if you generate a random one per user, he has to generate one per user. Much more expensive on the hackers part. This is why you can store a salt in plain text, it doesn't matter if the hacker knows it as long as there's more than one.

Security by obscurity is not good, microsoft has taught us that.


... until the attacker gains access to the DLL.