[db-wg] NWIs update

Gert Doering wrote on 10/04/2019 11:08:
> The attack vector against unsalted hashes is "rainbow tables"... make the
> API key something like 80 characters long, and no machine in the world
> can do anything but brute force.

which will work until the DB ends up on https://haveibeenpwned.com/

> But why store the API key anyway.  Have it contain permissions plus a 
> crytographically sane signature, and all you need to know is "in the key".

Sounds like it would cause problems unless you maintained a key 
revocation list.  Or unless you maintained salt-per-client in cleartext 
format, which doesn't sound like an improvement.

Nick