note 126448 added to faq.passwords

While I am reading the comments some old math lessons came into my mind and started thinking. Using constants in a mathematical algorythms do not change the complexity of the algorythm itself. The reason of salting is to avoid using rainbow tables (sorry guys this is the only reason) because it speeds up (shortcuts) the "actual" processing power. (((Longer stored hashes AND longer password increases complexity of cracking NOT adding salt ALONE.))) PHP salting functions returns all the needed information for checking passwords, therfore this information should be treated as constant from farther point of view. It is also a target for rainbow tables (sure: for much-much larger ones). What is the solution? The solution is to store password hash and salt on different places. The implementation is yours. Every two different places will be good enough. Yes, it will make problems for hackers. He/she needs to understand your system. No speed up for password cracking will work for him/her without reimplementing your whole system. This is my two cent. ---- Server IP: 45.112.84.4 Probable Submitter: 45.112.85.242 (proxied: 195.228.214.2) ---- Manual Page -- https://php.net/manual/en/faq.passwords.php Edit -- https://main.php.net/note/edit/126448 Del: integrated -- https://main.php.net/note/delete/126448/integrated Del: useless -- https://main.php.net/note/delete/126448/useless Del: bad code -- https://main.php.net/note/delete/126448/bad+code Del: spam -- https://main.php.net/note/delete/126448/spam Del: non-english -- https://main.php.net/note/delete/126448/non-english Del: in docs -- https://main.php.net/note/delete/126448/in+docs Del: other reasons-- https://main.php.net/note/delete/126448 Reject -- https://main.php.net/note/reject/126448 Search -- https://main.php.net/manage/user-notes.php