Hello Rowan Tommins [IMSoP], (Mirco Babin) >OWASP states, see >https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords-with-bcrypt
(Rowan Tommins [IMSoP]) >I looked up the attack discussed there, "password shucking" or >"hash shucking", and as I understand it, it requires >*the same inner hash* to be used somewhere else, that the attacker >can match *to that user*. (Mirco Babin) I did not write the article in question. I think these questions would be better addressed to OWASP. Kind regards, Mirco Babin
