Is time() a good salt?

后端 未结 9 1062
灰色年华
灰色年华 2020-12-02 05:40

I\'m looking at some code that I have not written myself. The code tries to hash a password with SHA512 and uses just time() as the salt. Is time()

9条回答
  •  盖世英雄少女心
    2020-12-02 06:36

    No! Never use the current time as the salt. You can use something like 'SecureRandom' in java to generate a random salt that is secure. Always use an unpredictable random number as the salt.
    Using time as the salt will help you to remove collisions only upto a certain extent(because two users can sypply the same passwords at the same time), but still make the passwords recoverable.

提交回复
热议问题