zakirkun Hardcoded Salt
Overview
A salt's purpose is to make each password hash unique, even when two users have identical passwords. A hardcoded static salt negates this purpose because:
- All users with the same password have the same hash
- Precomputed tables (rainbow tables) can be built for that specific salt
- A database breach exposes all passwords simultaneously
Remediation
Generate a unique random salt for each user:
import os
import hashlib
salt = os.urandom(32) # Random 32-byte salt per user
hash = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 600000)
# Store both salt and hash per user