Hacker News Reader

I have wondered the same thing. Make it a piece of data that comes in from the environment or a secrets manager. It’s not bulletproof, but if done correctly seems like it makes the whole hashing scheme a little better.

View on HN

If you are doing this isn't it pretty much the same as encrypting it with a key?

encryption is non-deterministic

if that was true, this article wouldn't exist: https://en.wikipedia.org/wiki/Deterministic_encryption

Some encryption algorithms are (effectively, but not literally) non-deterministic, e.g.: DUKPT, RSA-OAEP

Most encryption algorithms are deterministic, and most password authentication schemes depend on that fact.

Passwords aren't encrypted, so why would deterministic encryption matter?

Err, yes, good point. And if I had read the article first, I would have had the proper context of technical specificity loaded before commenting.

Nevertheless, most encryption algorithms are deterministic. :)

Reply on news.ycombinator.com