Can you use username as salt?
Yes a username would be good enough. The point of salting a password is to increase the bruteforce effort by a multiple of however many unique salts there are in the system. Some will insist that salts must be unique, but the point is to increase effort, thus deterring the attacker.
What does it mean to salt a password?
Salting is simply the addition of a unique, random string of characters known only to the site to each password before it is hashed, typically this “salt” is placed in front of each password. The salt value needs to be stored by the site, which means sometimes sites use the same salt for every password.
How are salt used in the hashing of passwords?
Recap 1 A cryptographic salt is made up of random bits added to each password instance before its hashing. 2 Salts create unique passwords even in the instance of two users choosing the same passwords. 3 Salts help us mitigate hash table attacks by forcing attackers to re-compute them using the salts for each user.
Why do I need to change my password hashing mechanism?
And changing your password hashing mechanism is a real pain because it means all the users have to change their passwords. The point of the salt is to be unique. The salt is meant to prevent attack cost sharing, i.e. an attacker trying to attack two hashed passwords for less than the twice the cost of attacking one.
What happens if there is no salt in hashing?
Sees duplicate hashes. Attacker can arrive to conclusion that there’s no salts or using a weak algo to hash the passwords. If they find a lot of the same hashes, sign that server has a default password and every new acct has a default password.
Why do user names spread hashes around less than a random salt?
Because user names have lower entropy than a random salt, so they spread your hashes around less than a proper salt does. Not that the example on that page is very spectacular anyway.