Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I can't explain why double the logarithm of the number of passwords stored would be the target. But it does make sense to have at least log_2(n) salts for n passwords. That would guarantee each password, even if they were all identical, would have a unique salt making every password hash differently (at least theoretically).

Now perhaps you would double that as a just-in-case scenario or because there is some fundamental property of every (existing or future) hash algorithm that causes a collision half the time (i.e. both salt 10001 and salt 10000 generate the same hash value).




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: