SecurityInnovation/TMContentReview — Issue #219: Store Passwords Securely
Author: SergeTruth
Created: 2011-11-07 23:31:35+00:00
State: open

"The key needs to be a combination of the password and some random salt."
This doesn't make sense. The key should not be predictable or limited.

"If possible it is helpful to choose a per user random salt to help prevent rainbow table attacks. Additionally, the salt should be stored separately from the password hash, ie. in a configuration file if the hash is in a database or directory. This prevents an attacker from gaining access to both pieces of information at once."
If the app is using a per user salt and storing the value in a configuration file, then managing the values entails writing a custom database.

The "Problem Example" does not highlight the problem.