Can I protect against password hacking just by salting the previous-hash

Question

I’ve seen some discussions where people suggest taking an existing password hash and salting it again instead of hashing the plain text password each time.

Would this method provide any real security benefits, or is it fundamentally flawed? Could attackers still brute-force the original hash, even if a second layer of hashing is added?

Answer 1

Enhancing password security is crucial in safeguarding user data against unauthorized access. The method you've encountered—taking an existing password hash and salting it again, raises important considerations regarding its effectiveness.

Understanding the Proposed Method

The approach involves taking an already hashed password, adding a salt to it, and hashing it again. This process is sometimes referred to as double hashing. The intention behind this method is to add an extra layer of security by further obfuscating the original password.

Security Implications

While the idea of adding layers to password hashing might seem beneficial, this particular method has notable drawbacks:

1. Limited Security Benefits: Hashing an already hashed password does not significantly increase security. The initial hash output has a fixed length and reduced entropy compared to the original password, which can limit the effectiveness of additional hashing.

2. Potential for Hash Collisions: Hashing the hashed output can lead to hash collisions, where different inputs produce the same hash value. This can inadvertently reduce the uniqueness of hashed passwords, potentially compromising security.

3. Vulnerability to Brute-Force Attacks: If an attacker gains access to the hashed passwords, they can still perform brute-force attacks to guess the original passwords. Double hashing does not inherently slow down this process or make it more computationally intensive for attackers.

Recommended Best Practices

Instead of relying on double hashing, consider implementing the following best practices to enhance password security:

1. Use Strong, Unique Salts: Generate a unique, random salt for each password before hashing. This ensures that even if two users have the same password, their hashed values will differ, thwarting precomputed attacks like rainbow tables.

2. Employ Key Stretching Algorithms: Utilize algorithms designed to be computationally intensive, such as bcrypt, Argon2, or PBKDF2. These algorithms apply multiple iterations of hashing, significantly increasing the time required for an attacker to crack passwords through brute-force methods.

3. Implement Rate Limiting and Account Lockouts: Protect against online brute-force attacks by limiting the number of failed login attempts and temporarily locking accounts after successive failures. This makes automated guessing attacks more difficult to execute.