Yes, password security is supposed to provide security even when a hacker gets access to all your data, but it doesn’t mean secrecy is completely disregarded, after all no one makes their password hashes database public, and leaks are still a security breach even if the passwords were hashed and salted correctly. So storing it in a harder to compromise place (outside the database, outside the hard drive, outside the computer, whatever) is only “cheating” if you completely rely on it and assume it would work. Which I didn’t. My problem with the first method is exactly that, that it’s useless if the secret stops being secret.
But, if you really want you can still store them in the database, The important point is that you don’t store which peppers are used for which users, which you still do for salts even if you try to hide them somehow.
The hacker does get slowed down almost 100X with a 100 peppers when cracking passwords, since to reject a password they have to try all the peppers, and most likely they have to try a very large number of passwords before finding the right one. On authentication it does take on average half the time, since you usually check correct passwords.
Yes, password security is supposed to provide security even when a hacker gets access to all your data, but it doesn’t mean secrecy is completely disregarded, after all no one makes their password hashes database public, and leaks are still a security breach even if the passwords were hashed and salted correctly. So storing it in a harder to compromise place (outside the database, outside the hard drive, outside the computer, whatever) is only “cheating” if you completely rely on it and assume it would work. Which I didn’t. My problem with the first method is exactly that, that it’s useless if the secret stops being secret.
But, if you really want you can still store them in the database, The important point is that you don’t store which peppers are used for which users, which you still do for salts even if you try to hide them somehow.
The hacker does get slowed down almost 100X with a 100 peppers when cracking passwords, since to reject a password they have to try all the peppers, and most likely they have to try a very large number of passwords before finding the right one. On authentication it does take on average half the time, since you usually check correct passwords.