When it comes to password security, there are things that people agree, such as storing salted password hashes, which provides statistical protection against a hacked model and data.
That some do not seem to agree on what to do with the salts. There are many methods that you can do to try to protect the salts, but many experts suggest that they are just meaningless obfuscations of the safety model, and that the model will be exposed over time, and I do not agree with this, but I may not understand the other point of view.
What I don’t understand is if your model is compromised, why should you accept a full compromise instead of a partial one? If your security model is distributed between different infrastructure components that are not equally protected, a partial compromise may not even be a problem. (If you do something like, say, encrypt the salt and extract the encryption key from a more secure environment, which is less likely to be compromised).
I assume that the compromise is not always 100%. I have never been hacked into a system, and I never hacked into it, so I do not have a complete picture.
source
share