I Sell Onions on the Internet - <AUTHOR> https://www.deepsouthventures.com/i-sell-onions-on-the-internet/ <comment><USER5> > I backordered the domain as a spectator, but for kicks & giggles, I dropped > in a bid around $2,200 'cause I was confident I'd be outbid.

It's funny and beautiful how a moment of whimsy ends up being a fulcrum point in his life.

It seems there's a lot of interest in gardening / food production among tech people. For me, one of the reasons I love gardening is because in many ways it's totally different from working inside with machines, but there are important and unexpected overlaps. For example if you have a solid understanding of the OSI model which informs your method of system design, you can easily move into gardening where knowledge of the layers of a forest plays a similar role. Having this experience in tech makes it easy to zero in on similar structural principles in gardening, learn about them, and _apply_ that knowledge whereas many others clearly don't.

Just like a person who doesn't understand the value of a proper foundation in tech (hardware, lower protocols like DNS, etc.), a similar gardener won't first seek to build strong healthy soil, and they will constantly fight against nature rather than work with it, doing more work while getting fewer results.

As an aside, regarding onions: last year I cut off some green onion bottoms from the store and put them in the ground (including the little roots). They grew back and gave several more green onion harvests before winter set in, and now they're back on their own! Permanent green onion. You can do this with a number of plants, btw. Try it!

<comment><USER6> Moments of whimsy are some of the most important. It was a moment of whimsy that led to me studying abroad in college, and another moment of whimsy that led me to meet my wife while I was there. Couldn't have been more than 5 total minutes of thoughts no more complicated than "yeah, I guess I'll give it a go" that shaped my entire life.

And yet, I can spend another 5 minutes in the grocery store agonizing over which of two near-identical bags of chips to buy. Funny how that goes.

<comment><USER7> Isn't that just confirmation bias though? If you hadn't made those decisions you just as likely could have met someone else some other way, married them and been just as happy or successful.

<comment><USER8> Yes, but it contrasts nicely with those "where do you see yourself in five years" interview questions. Life doesn't usually work like that.

</comment></comment></comment></comment><comment><USER9> Just look at the dignity here in this humble creation he has made!

> [...] she interrupted me mid-sentence and hollered in exaltation to her > husband: " THE VIDALIA MAN! THE VIDALIA MAN! PICK UP THE PHONE!"

The happiness I feel reading that is so sublime. His work is needed and appreciated -- and what a humble trade with a beautiful simplicity to it. It is repeatable; others could do this too! Imagine what our communities would be like if most families had a little something like this. It reminds me of G.K. Chesterton's "Three Acres and a Cow" [1] slogan (implying that can be enough).

[1] [https://en.wikipedia.org/wiki/Distributism#Economic_theory](https://en.wikipedia.org/wiki/Distributism#Economic_theory)

<comment><USER10> I hope I wasn't the only person here who thought of the egg man scene in Pink Flamingos when they read this :)

<comment><USER11> [https://www.youtube.com/watch?v=elzEOs2pY38](https://www.youtube.com/watch?v=elzEOs2pY38)

</comment></comment></comment><comment><USER12> I actually had this exact same idea in like...2011. So, ideas are worthless without execution. I used to work in Middle Georgia where Vidalia Onions are plentiful. I went to visit a friend in NYC, where Vidalia Onions are scarce. I brought some with me on the plane...

The plan was I'd just run to the local grocery store and just fulfill online orders and if demand was there, purchase from local farmers. I didn't get any further than than just mentioning the business idea. Kudos to Peter for executing and meeting a need. Looks like he also owns onions.com, so they are making enough money to acquire that domain name.

<comment><USER13> > So, ideas are worthless without execution.

This is such an excellent quote and motivational.

<comment><USER14> So much so that I made this for fun a few months ago :)

[https://www.ideasarecheap.net](https://www.ideasarecheap.net)

</comment></comment></comment><comment><AUTHOR> Peter here (author) - happy to answer any questions..

<comment><USER15> Hi Peter,

Congratulations! You're an inspiration. A few questions, if I may:

1\. Do you plan to expand to other produce other than just the onions?

2\. How did you arrive at your current business model (like min order quantity, areas served, return policy, shipping rates etc)?

3\. How do you deal with customer complaints, in particular, with something as prone to decay as organic produce?

4\. What significant part of the way you do this business changed after v1? Esp, as multiple customers would have inevitably given you comments and suggestions.

5\. You mentioned you're registered as a LLC. You don't intend to raise VC money? For instance, YC prefers not to invest in LLCs.

6\. What does the tech stack look like (Shopify? Weebly? AWS? Frameworks? Payments? etc)?

<comment><AUTHOR> 1\. Right now, we're concentrating on just Vidalias. We continue to grow at a pace I'm happy with, so there's no need to get complicated. 2\. We learned it as we went along, really. ie, "Oh crap, X happened.. what do we do?" And then we figure out what's best for the customer, and do that. 3\. We listen, and empathize. I want all our customers to get the onion they're expecting. If they don't, I'll cover the cost to get them more that meet their needs. 4\. The logistic changed the most, by far. Our second year, we added order tracking, and that helped a lot too. (Our first season, the customers would call me and ask where their order was, and I'd manually look it up) 5\. We're profitable. I have no interest in raising money or taking direction from a VC. 6\. Tech stack (if I even understand what that means).. Wordpress, Shopify

<comment><USER11> Just chiming in to say that I loved reading your article, and I really wish you all the very best. I'm you have inspired many people in one way or another!

</comment></comment></comment></comment><comment><USER16> This is an American dream-esque article about a boy and a domain name. They meet, he wins the auction, and they start spending time together. The domain name, she calls to him and eventually they hook up with an industry group and bring onions to the world. While on the face of it, this may not seem like the best business plan - I actually really like it. He found something personal (domain knowledge from his home state industry), something with a good customer need, and filled a niche of better customer service and process. Here, everyone wins... So I guess it is also an 'invisible hand of the free market' dream too.

</comment><comment><USER17> I want someone to write some analysis of this particular... voice, or style of writing, being used here.

"I'm a web guy. I'm not a farmer."

I already knew that, because in just a couple paragraphs, I was already recognizing the style of writing as... SEO, "influencer", I don't know what to call it?

It's a personal first-person voice, which right off the start tries to establish that the author is a human being writing about their life -- but also that they are an expert in what they are going to tell you about, and _very successful_ too.

The text includes many one or two sentence paragraphs, and has aggressively styled pull quotes and/or callouts. Short sentences too. Not entirely complete sentences. Interspersed.

It makes sure to open up with some kind of very short story that is only tangentially related to the content but is folksy and cute. (Smuggled vidalia's onto cruise ship).

The information is very cleverly structured to keep you reading, by dropping _just enough_ of the actual info, page to page, to pique your attention and make you think there's an interesting story here, but not enough that you can leave having actually learned anything before you've read a pretty big chunk. And is written artfully for this purpose, it works, and keeps you reading. Sometimes at the end you feel rewarded, other times you feel like it was a shaggy dog story. The best authors leave you happy, of course.

It's got information to convey, but the goal is not to convey the information as effectively as possible, but to keep you reading as long as possible -- and, usually, to sell you something.

I don't know if I have a value judgement on it exactly -- okay, I'll admit it annoys me, perhaps because it _all sounds the same_ while trying to convince you it's a folksy authentic voice. But either way, it's a _thing_ , a genre even, that I'm not sure I've seen anyone comment on.

It's: "Content Marketing Voice".

(Also selling people onions on the internet is "purpose over profit", really? What the world needs now is frictionless access to vidalia onions shipped directly to your home?)

<comment><USER18> I think it's possible to be using a genre voice unconsciously, or doing it consciously but for your own purpose. Just because the genre is X, doesn't mean we can assume the purpose.

I think you missed the point about "purpose over profit", it really gave this guy a feeling of that. And him telling that personal story is valid. It's interesting to think about why you seem to have deliberately side-stepped the point of the story.

Actually, analyzing and thinking about the way you wrote this comment, it seems you're just bitter that someone found something they really liked, that gave them a sense of purpose, and now you're trying to find some way to diminish that to yourself, to make yourself _feel_ better, without actually taking the responsibility to _do_ something to make your life better. Which tells us that you wished you had that purpose, but you feel you don't.

Some free advice: go about making that purpose for yourself, rather than making yourself feel better by trying to diminish the achievements of others that trigger you right in the feels. Another way to say it is, instead of making it all about this guy, when you get triggered, stop and think about "why do I feel that way?" and go deep into that. It's not about other people. What you feel is about you. Learn from that. Don't project, don't take it out, don't blame others, just learn from that uncomfortable emotion you're writing this thing to avoid.

Don't get me wrong, this is more than advice. I've seen that attitude cause a lot of unnecessary hurt and conflict in the world and in relationships, and I want people to stop it.

It's a pattern I've see a lot. Definitely has it's own genre voice as well.

<comment><USER17> > I think it's possible to be using a genre voice unconsciously, or doing it > consciously but for your own purpose. Just because the genre is X, doesn't > mean we can assume the purpose.

Certainly. It is still interesting to analyze as a genre, this is how we make sense of the written world. Perhaps you are doing that same assumption of purpose with my writing.

> I think you missed the point about "purpose over profit", it really gave > this guy a feeling of that.

Is the point of "purpose over profit" to engender a _feeling of purpose_ in the people who think they are doing it? Is that the "purpose"?

I think everyone should endeavor to treat their customers, suppliers, and coworkers with respect as human beings, instead of trying to take them for all they are worth. I agree doing so _will_ make you happier. Which can perhaps be surprising to someone who tries it and has never done it before, how much it improves their own life. This is called being a decent human being, and there's no reason for everyone in every job not to do it. There's nothing wrong and a lot right with trying to behave like a decent human being in whatever business you are in, it's commendable, but it's not "purpose over profit."

I think it's disingenuous to elevate the idea of "treating people like humans instead of just instruments for my own profit, while at my profit-focused endeavor" to "purpose over profit", and disrespectful to people who really do make significant material sacrifices for a non-profit-oriented purpose.

What do you think his "purpose" was here, and in what ways were any profits sacrificed for it?

</comment></comment></comment><comment><USER19> This was really fun, so I checked out the site

\- Least expensive order is a 5-pound box for $34.95

\- Runs on Shopify

\- As they're seasonal, there are some built-in scarcity aspects I hadn't thought of (which is kind of neat business wise).

Two aspects I might try if this was my business:

1\. Some kind of "Chef/Restaurant" option

2\. An option to send 1 beautiful onion (ala the referenced Harry and David's)

<comment><USER20> Seconded: I would totally pay for 'ship this person an onion'

<comment><USER21> Grade your onions and sell the top 10% at a premium!

I sincerely believe that our society would be much happier and healthier if top-shelf/"celebrity" vegetables existed that could cost $XX, sort of like in Japan.

Someone would probably pay $1000+ for "The best dozen onions of the season"

<comment><USER22> It's the opposite that's a bigger problem, a lot of all fruit and vegetables are thrown away because they're not perfect looking.

[https://www.theguardian.com/environment/2016/jul/13/us- food-...](https://www.theguardian.com/environment/2016/jul/13/us-food-waste- ugly-fruit-vegetables-perfect)

<comment><USER23> "You eat with the eyes first" is a common cross-cultural idiom. I'm not saying it justifies the waste, just that it's probably an evolved human behavior that we're stuck catering to. At least there is a counter-culture _ugly produce_ movement right now.

</comment></comment></comment></comment></comment><comment><USER24> I spent a minute thinking about a product local to me that had the same appeal. I typed [http://michiganlamb.com](http://michiganlamb.com) into the browser and discovered the concept is not uncommon.

<comment><USER25> Yes, I think it's pretty common (here's one around me: [https://locavoredelivery.com/](https://locavoredelivery.com/) ), but still delivers value and can be a good business.

Reminds me that middlemen provide value in a lot of ways, even though they are hated and everyone thought the internet would disintermediate them all.

<comment><USER26> Yep. Even if it has never been easier for the maker/producer to setup their own Shopify store, it's still not enough. Sure a decent website on shopify is better than nothing, but most likely only your current customers will go. You need extra skills to bring NEW customers: marketing, SEO, social media, etc.. and chances are that it's someone else that will have those skills.

</comment></comment></comment><comment><USER27> That's awesome. A couple responses to yesterday's thread regarding bookmarked hn quotes really opened up my eyes regarding building and maintaining side projects. I picked up a book, "Start Small, Stay Small: A Developer's Guide to Launching a Startup" which has been informative (if a little dated). This article is a great supplement to that book, and is inspirational to a 9-5'er like me.

[0][https://www.amazon.com/Start-Small-Stay-Developers- Launching...](https://www.amazon.com/Start-Small-Stay-Developers- Launching/dp/0615373968) | [https://startupbook.net](https://startupbook.net)

<comment><USER28> Author of Start Small, Stay Small here.

>> if a little dated

Argh! I know. I literally opened the Doc this week to start to parse out sections to update. It's overdue ;-)

<comment><USER11> This is one of the reasons why I love HN so much.

</comment></comment></comment><comment><USER29> This story brings a tear to my eye.

I'll see myself out.

But seriously, this is the type of side projects I dream of. Not the next soul sucking social network, but rather something meaningful and real.

<comment><USER30> Your comment resonated with me. I'm just about the launch the a social network. Our whole goal was to design around authenticity, something that is severely lacking in other offerings.

<comment><USER31> If I were to offer some unsolicited advice. Authenticity arises out of real communities, and that is something social networks are quite bad at. They often focus on the self much more than communitiy participation. I think that's why old chat networks and forums were so good at building communities, as you had to truly contribute to be part of them. You didn't even have an identity until you contributed to the community and revealed it while doing so.

Current social networks allow you to hit "join" or "like" and that's all the participation you need to get your validation. You're part of the group just by signing up, rather than because you helped make it a community by contributing.

That's probably why this story resonates with people here so much. It's not just a tech business, it's an attempt to contribute and be an integral part of the local community. Not something every startup gets to do.

<comment><USER30> Absolutely agree. We have made some design decisions to force consideration into the social aspect in the aim of increasing the quality of interactions.

</comment></comment></comment></comment><comment><USER32> It sounds like he created a co-operative. This is the case in Oregon where lots of milk growers...er...dairy farmers pool their resources into a funnel organization, Tillamook Farmer's Co-op, that handles packaging, distribution and marketing. This is such a wild story tho, I loved reading it.

<comment><USER33> Not really a co-op. Unless I misunderstood something, he contacted a single farm and is basically acting as their digital marketing side. They got so good at this that the other farms in the area decided to stop competing on this front(DTC online sales) and focus on other segments of their business. That's what I assumed he meant when he said "other farms started sending people our way".

I believe M&T is a single farm/growing operation.

<comment><USER34> There are very few co-ops in the South as compared to other parts of the world. There is a lot more direct-to-mass production/buyers farms here as well as a lot of "factory" farming.

That being said what he's doing is something that is hard to reproduce simply because Vidalia onions cannot be grown except in a certain geographic area. You can take the same onion and grow it elsewhere, it will taste exactly or very close to the same, you just cannot sell it as a Vidalia. I'm surprised that there aren't more of the boutique style shops for things like Vidalia onions, Georgia peaches, etc.

Source: born, raised, lived whole life in Ga within a farming family.

<comment><USER35> It's weird that this was done with special legislation. I see that the US does not have any general mechanism for such situations, although it has done this for these onions and for Tennessee whiskey specifically.

The EU has a system-wide concept of products (mostly but not exclusively foods) that are by definition produced in a set region, by a particular method etcetera called the Protected Designation of Origin. This is inspired by laws in some of its member states (most famously France's AOC laws which protect Champagne) but because it's a system rather than being stapled into the law for one specific product it makes it practical to use for less famous things where the heavy lifting of actual legislation would be too much to ask. If your town produces a peculiar furry hat, and then one day sales of the furry hats begin to drop off because it turns out somebody is making replicas in China and selling them under your town's name, applying for PDO is a relatively straight forwad way to fix that across the entire EU without trying to attract attention from legislators in two dozen countries.

Of course PDOs can be abused (e.g. arguably protection of Newcastle Brown Ale was pointless, its only producers were indeed in Newcastle, but when they decided to move they simply applied to discontinue the PDO status...) but overall it seems like having a framework makes more sense than only doing this as actual national legislation (a rule saying Vidalia onions are from Georgia only works because the US government enforces it, the part in Georgia state law has very little effect)

<comment><USER34> The effort was initially at the state (Georgia) level in 1986. Then the producers pushed to have the Department of Agriculture make the area the official designation at the federal level. This was done later in 1989.

</comment></comment></comment></comment></comment><comment><USER36> As of 5 minutes ago I am now the proud owner of VidaliaOnions.co.uk..... UK vidalia market here I come!

<comment><USER37> Vidalia onions come from Georgia, in the agricultural belt south of Atlanta.

I know you're probably joking, but you should order some. They're delicious.

<comment><USER36> I actually wasn't joking, I did buy it (it was unregistered so it was only 6 quid), but now perhaps it was rather pointless if Vidalia onions only come from around Georgia. I just read the article and then googled to see if the uk domain was free.

</comment></comment></comment><comment><USER38> The most impressive thing was the bit where he spent 2 grand on a domain name he didn't want and didn't think "Oh shit, I've just blown 2 grand I needed to..."

<comment><USER23> I've worked in the domain space. Two grand is not that bad of a deal for a semi-common object, especially if there is an industry behind it.

</comment></comment><comment><USER39> Turning a domain name into a business.

Even more simple than that really, taking an existing industry and using a domain name to create a front end to that industry.

There is opportunity everywhere. Especially if you don't require creating a billion dollar company.

Thanks for sharing Vidalia Man.

</comment><comment><USER40> It was a fun read. But also a bit sad that it takes thousands of dollars and a lot of available time (which many people don't have) to do something as fundamental as this.

<comment><USER41> I have available time. Get me someone with thousands of dollars (and willing to risk them) and let's collaborate!

<comment><USER42> I've thought about this a lot lately. I have (some) money, but not a whole lot of time. It's really hard to find reasonable direct investments for "down payment on an investment property" style money, with "rent from an investment property" expected returns. Seems all that's available at that level is more or less gambling on potential unicorn style stuff.

Or put other way - I'd love to find some great "regular" business ideas to both fund and assist in getting off the ground to the tune of $5-50k, and if successful make a few thousand a month down the road in a couple years - <USER2> millions on some future exit.

Basically I want to seed-fund/invest in/be involved in what HN calls "lifestyle business" \- just a regular old sustainable business expected to grow 10% a year and comfortably employ a couple founders and employees.

Many good reasons this market doesn't exist and is "hard", but one can wish. It would feel fare more satisfying to invest money in actual hard working people with real but boring (read: low risk) business models than tossing it into the S&P500 or engaging it yet more rent-seeking by buying up small properties to turn into rentals.

<comment><USER43> I listened (again) to an Indiehackers podcast with Rob Walling this morning where he described pretty much that problem. He had "lots of" cash and "little" time to spend in building a business from scratch. What worked was to find a business he liked that wasn't making much money, but could be bought for cheap (he overpaid!) and turned into something that made money.

To respond to the "rent from investment property" concept, you can get in on investment properties at a fairly low price (IIRC 40% discounts) if you invest when builders are looking for prospective buyers. i.e., before anything is built. I looked into doing this some time ago, but the builder couldn't find enough buyers, so the property was never built.

<comment><USER44> "you can get in on investment properties at a fairly low price (IIRC 40% discounts"

I've been trying to work this out, that seems like a massive discount, what's the expected profit margin for the builder? Surely not much more.

Why not get a loan? Would be cheaper, certainly on the land. I don't get it, something doesn't add up for me.

<comment><USER45> In a number of situations that I have been involved in (Canada), the builder cannot get funding from traditional sources because there's no tangible asset to fund, and the builder still hasn't obtained permits from the municipality, etc (the necessary boilerplate to get going on construction). In these cases some builders will seek out a lawyer that will pool together funds from various investors and the loan rate is typically 15%-25% which makes for a nice profit, but with the knowledge that it could blow up. Once the permits are in place, then traditional funding comes a lot more readily.

<comment><USER44> I mentioned land, that's a (the?) tangible asset.

The situation you're describing seems to suggest that it would be better to split up the permitting and the building.

Company A buys land, gets permits, then either sells on to a builder, or contracts a builder.

But then I don't understand why so much capital would be required just for getting permits.

I'm guessing it's another example of different countries doing house buying/building differently, and none of them optimal.

<comment><USER46> >But then I don't understand why so much capital would be required just for getting permits.

There are lots of permits that only become available much later in the process. For example, an occupancy permit is only granted once the building is in a habitable state.

There are always permit delays of some kind or another because no matter how much research and planning you do, there are things that are simply unknown or that have to be changed (and thus re-permitted) at the proverbial last minute.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER47> Couldn't help but think of this [Planet Money episode]([https://www.npr.org/sections/money/2015/10/14/448718171/epis...](https://www.npr.org/sections/money/2015/10/14/448718171/episode-657-the- tale-of-the-onion-king)) about a man who cornered the onion market with some repercussions.

</comment><comment><USER48> > universally, the domain name always comes first, the business idea comes > second.

I wonder what others think about this quote. Could he not have started the same exact business with another domain? Is owning the "right" domain that important that is should "come first" and be forgotten without it? naively I'd think Google@2019 gives more importance to content then to the domain name. No?

<comment><USER49> Feels like that's just his way of brainstorming ideas for side gig. Some of us get inspiration from problems we run int ourselves, some actively read blogs, blogs, trends, etc and try to find opportunities, while this man gets his from finding descriptive domain names.

</comment></comment><comment><USER50> It seems like operating an online business is 5% software hackery and 95% finding a cool thing to sell, finding a supplier, building a supply chain and fulfillment system, and customer support. Think about it like this: if you can find a thing to sell on a street corner, you can sell it online. Seriously. Say you found these awesome fucking USB-C cables for about $1/each from a Chinese supplier. You think people will pay about $15/each for them, so you set up `awesome-fucking-cables.com` and start selling them. Registering a domain and setting up a web shop is the easy part, but it tends to be what people focus on.

Some ideas of the stuff you could sell:

\- Kombucha

\- Specialty sodas

\- Heirloom seeds

\- Specialty light bulbs and/or batteries

\- Spice packets

\- Carpet cleaning powder

\- Dice

\- Specialty candles

\- Prepared origami paper

\- Specialty pens/pencils/crayons

\- Funky hair accessories (someone recently asked me why there aren't many superhero themed ones because it would be a huge market)

<comment><USER23> My wife paid for her grad school entirely by selling direct-from-manufacturer fashion goods, from China, to middle-aged upper/middle-class women in central Europe. The crazy thing that made it all work, IMO, was that the website was invite only. The women used the exclusivity as a status in their social circles, and invites as favors.

It's fascinating how these small market niches exist but it really is the other 95% that makes them take off.

</comment></comment><comment><USER51> Great story. One quick bug report: your Bulk & Wholesale page has a broken contact form: [https://www.vidaliaonions.com/bulk- wholesale/](https://www.vidaliaonions.com/bulk-wholesale/)

<comment><AUTHOR> darnit.. thank you.. now fixed.

</comment></comment><comment><USER52> Originally I was expecting an article about mining .onion domain names, but this is good too!

<comment><USER53> Though vidalia.onion would be a stylish domain name. It'd be better than vidaliaonion.io.

\s

</comment></comment><comment><USER54> Lots of posts nowadays are just people humble bragging. This was read as an honest account of an enjoyable business ride.

Thanks for sharing this!

<comment><AUTHOR> you're welcome! Thank you for that feedback - I was concerned that it'd come across as a humblebrag.. I just like sharing neat things people can do on great domain names.

</comment></comment><comment><USER55> I buy domain names for weird and random ideas that come to me. I really like the reverse concept of buying interesting domain names and then letting them turn into something that you never anticipated. That sounds like a really fun and potentially highly rewarding hobby. It also seems to break every Startup book's rules, since you're looking for a problem to a solution, but who cares? This guy is having tons of fun and learning a lot, so good for him.

Edit: Looks like they have some competition: [https://www.vidaliaonion.org](https://www.vidaliaonion.org)

<comment><USER56> That looks like more of a marketing arm of the state of Georgia or some regional agricultural or co-op entity. Not selling onions directly.

</comment></comment><comment><USER57> Thanks for such a great read. I have a somewhat similar story.

My brother and I started our company the moment after we bought our domain name: retreat.guru. We actually wanted a different domain but didn't get it; retreat.guru was the runner up. Then we had a spontaneous 3 hour call where we mapped out the entire global wellness retreat marketplace we would build - <USER3> based off the domain name! 5 years later we are still going strong.

We are based out of a small mountain town in B.C. Nowhere near the buzz of Silicon Valley. We gradually took investment and grew from revenue as well. We are very vision driven.

'I sell ayahuasca retreats on the internet'

:D

</comment><comment><USER58> What I liked most about this story was the fact that he went into it kind of ass-backwards - domain name first (almost by accident too), then the business.

<comment><USER23> That's what makes this story unique. The domain speculation industry thrives almost entirely on the opposite.

</comment></comment><comment><USER59> Sort of ended up in a similar boat: I sell hemp on the internet at [https://www.cascadiablooms.com/direct](https://www.cascadiablooms.com/direct)

These stories are good to tell, sometimes what can help a farmer the most is just someone who can help market and sell their crop.

</comment><comment><USER60> I'm a sweet onion fan. I didn't realize that Texas sweet onions were a different variety: [https://www.texasmonthly.com/food/the-texas-sweet- onion/](https://www.texasmonthly.com/food/the-texas-sweet-onion/)

(They're real good)

</comment><comment><USER61> Why didn't the farmers just independently open an Amazon shop before he came along? Is it just the case that they're not tech savvy enough?

I'm not downplaying what he did - it's really cool - what I'm trying is to get a better sense of the business dynamics here.

<comment><USER62> Like the other reply says, it's probably just the farmers don't have time or don't want to.

I expect you could make the same comment about just about everything on the planet that is grown or made, but then sold by someone else. The original person could try to sell it to consumers, but that would take so much time and effort they wouldn't have time to grow/make the thing in the first place!

</comment></comment><comment><USER63> Great read! The blog has another post which I found personally interesting -- Slow Down & Wander [1]

[1] [https://www.deepsouthventures.com/slow-down- wander/](https://www.deepsouthventures.com/slow-down-wander/)

</comment><comment><USER64> This is really inspirational: who knew that such a rudimentary site could be a viable business?

<comment><USER65> Craigslist, or perhaps Tarsnap, or many others providing services to people who know exactly what they're looking for.

Being flashy helps sometimes if your customers are fickle and you need to sell them on something they didn't know they wanted, but if you've got an enthusiast audience or specialized product, substance is all that is required - at least at a fundamental level.

<comment><USER66> Every junkyard website is basically just a business card with the ability to search their inventory (or the fraction of it they choose to list) on car-part iframed in.

</comment></comment></comment><comment><USER67> Thoroughly enjoyed this. I'd love to read a bit more detail on his process of spinning up the customer relations sides of the business that he mentioned. What was the hardest thing to get right? What were the unexpected pitfalls?

<comment><AUTHOR> Peter here (author).. happy to share a little more. I oddly enjoy the customer relations side the most. It's so old school - alot of my customers are surprised when a real human picks up the phone to take their order. The hardest thing to get right (and we continue to refine) is the logistics part. The pitfalls I encounter are the very tight margins. If I take my eyes off of operations, I could quickly go under water.

</comment></comment><comment><USER68> Just be careful of [https://en.m.wikipedia.org/wiki/Onion_Futures_Act](https://en.m.wikipedia.org/wiki/Onion_Futures_Act)

<comment><USER69> Oh wow, that's wild.

</comment></comment><comment><USER70> Buy buy buy, they are shipping soon: (I'm not affiliated in any way)

[https://www.vidaliaonions.com/](https://www.vidaliaonions.com/)

</comment><comment><USER71> How was organic traffic in the early days?

You're now ranked #1 for "vidalia onions" in Google -- but, I'm really curious what the evolution was after buying the domain?

</comment><comment><USER72> Thanks for sharing your story. I think there are a lot of people out there like me not looking to be a unicorn company, but would love to be the next VidaliaOnions.com

</comment><comment><USER73> That's the kind of lifestyle business I dream of finding myself into. Except maybe I'd want it less involved with customer service, but roughly similar. Somehow that's much more appealing to me than heading the next big buck hot startup out of my SF penthouse office. Guess there has to be some for everybody :) That was a good read and I bet that to the core more people resonate with this than most startup jobs!

</comment><comment><USER74> I loved this piece. I'm from Florida and Vidalias are a staple.

Whole wheat bread, lightly toasted with a smear of mayo and a thick slice of Vidalia. Mmmm... So good.

<comment><AUTHOR> add cracked pepper and a squeeze of lime.. mamma-mia!

</comment></comment><comment><USER75> sorry about a tangent, but that Indian Jones scene bothers me so much. i mean... there are so many safer ways to validate you _can_ take that first step. i'll name a few

        1. crouch down and reach out your leg gently tapping the "invisible ground"
        2. throw a pebble.
        3. throw a bunch of sand to see exact available surface area.

i mean.. he's a scientist.

<comment><USER29> It's a leap of faith, you're not supposed to cheat it. However after crossing the bridge, he DOES scatter sand over the surface area revealing the bridge (which was really just a camouflaged stone illusion shown by an alternate viewpoint)

<comment><USER75> _he DOES scatter sand over the surface area revealing the bridge (which was really just a camouflaged stone illusion shown by an alternate viewpoint)_

that's the point of my rant! :)

<comment><USER76> Yeah, but he did it AFTER the leap of faith. It makes all the difference. This is all about letting go of your ego.

</comment></comment></comment></comment><comment><USER77> I'm not sure I've ever seen such a highly-voted post.

I checked using the search box, and it appears this the 12th most voted post of all time (so far!).

</comment><comment><USER78> This is what a marketing piece should be. This is an ad I'm happy to read. Were I in the US, I would totally order onions from this guy.

</comment><comment><USER79> "I'm addicted to Domain Names... but for kicks & giggles, I dropped in a bid around $2,200".

Not trying to be a killjoy, but everytime I hear about people reserving domains for fun or future, it just tells of so much privilege. Americans and other Westerners people have already reserved so many domains. Domain name squatting always is a rich-get-richer story.

</comment><comment><USER80> This is by far my favorite post on Hacker News. :D

</comment><comment><USER81> I would say this is crazy, but truth be told... if I saw someone selling like super high quality heirloom tomatoes online... I'd probably buy some. But what I've actively searched out, and have yet to find is someone selling lobster stock. Sometimes if i'm lucky, I can pick up some from my local fish monger... but it's uncommon.

<comment><USER82> Probably what's holding that back is shipping cost since stock is mostly water, quite heavy and needs to be sent frozen or at least cooled with freezer packs, further adding to weight. My favorite place for andouille sausage [1] will ship cooled packages but the shipping costs are roughly equal to the product cost. So whenever I drive to New Orleans I take an ice chest with me netting twice the product for the same price.

[1] [https://www.cajunsausage.com/](https://www.cajunsausage.com/)

<comment><USER81> There's a way to make it by reducing most of the water away so you get a 20x concentrate that's quite shelf stable... and probably cheap to ship. Here's an example ([https://www.morethangourmet.com/](https://www.morethangourmet.com/)) these stocks are quite good.

<comment><USER82> I shall bookmark that. Thank you.

</comment></comment></comment></comment><comment><USER83> So, only slightly related to this article, but I'll say it anyway:

I've bought domains for years. Through that process, I've developed a specific routine to evaluate a name prior to purchasing.

I've been sketching out a plan to build a web app that largely automates this evaluation process, that I would hope to release as a small side project SaaS in the future.

Anyone here interested in such a thing?

<comment><USER84> Can you share the "specific routine" you developed? I understand if it's your secret sauce and you want to keep it to yourself, but I also would never use this if I didn't know how it worked.

<comment><USER83> It's actually not that crazy/secret, it's simply compressing a many-step process down into a single, flat step. Whenever I'm looking for a good domain name, I'm trying to consider things like searchability, is the .com available, are there no shorter .com's taken, are there already projects/apps/sites with very similar names out there, do the Google SERPs come back with off-putting results, etc.

I have done this by hand for a long time, but it's error prone and time consuming. Very straightforward to automate down into a one step process.

</comment></comment></comment><comment><USER85> My wife is from Georgia, and I've visited many times.

I don't really like onions. But real Georgia Vidalias are something special.

</comment><comment><USER86> Reading his article I cant help but wonder why he isnt scaling his entire setup to help ALL farmers, regardless of what they are farming, to sell online. Cant he create an online marketplace and onboard basically every portable vegetable? He should be able to replicate this same model with every veggie we got.

</comment><comment><USER87> Reminds me of the accidental tumbleweed magnate:

[https://www.business-opportunities.biz/2013/04/10/the- worlds...](https://www.business-opportunities.biz/2013/04/10/the-worlds-most- successful-accidental-tumbleweed-saleswoman/?amp)

<comment><USER88> Is that a business opportunity? Something like "develop my domain"? Like a land-owner who lets tenants develop?

So, you pay for the domain name, list it on the development site, and a developer (say me) can pick and choose from what you have and build a product on your property.

There's a contract, you get x% of proceeds from my endeavor, I get a domain name specific to my needs, and we all benefit. The contract would also specify a dwell-time. I get 12 months, or 2 years, or whatever on the property.

Then the contract comes back up for negotiation. Maybe a sale is negotiated (you want my development, or I want your domain name).

<comment><USER87> If I have OnlineTumbleweeds.com and you like the idea of developing it, why wouldn't you just buy TumbleweedsOnline.com? I don't see what value the domain owner is adding. There's not going to be a ton of SEO value to an old domain that's just been parked.

<comment><USER88> Fair enough. I was thinking that perhaps owners of desirable domain names (short, catchy, specific, etc) who also don't have the time for development could benefit.

But, I think you're right. There'd be a lot of not-so-desirable domains to sort through.

</comment></comment></comment></comment><comment><USER89> This was an amazing read. Not only do you sell onions on the internet but you are an amazing writer! I had to stop and comment before I dived into what else you've written.

I copied the quote "take the path to Nothing, and go Nowhere until you reach it." and got it turned into a canvas to hang above my desk.

<comment><AUTHOR> if you like that quote, I highly suggest reading (or listening to) the book: The Tao of Pooh ... sooooo good.

</comment></comment><comment><USER90> Agree with the other comment saying this was fun and exciting to read -- very well written and makes a strong point. I fully hope, when I am able to get off my lazy ass and do something, to sell a simple physical product that people already want. Food's a great example of this.

</comment><comment><USER91> As a Georgian transplanted into California, I miss these onions so much. Great read as well.

</comment><comment><USER92> I've been umming-and-ahhing over an entrepreneurial endeavour for a while now. I'm very tempted now to just go out there now and see if I can get a good domain name. Letting the domain make the business decision for me seems fun.

<comment><USER93> This is a potentially addictive and risky venture. I've personally bought hundreds of domains over the years, and professionally in the thousands. I've probably broken even or profited a little. Most of the domains I buy for the name just sit there unused for 5+ years.

<comment><USER92> I don't necessarily mean as a career path. More-so as an out-of-work hobby to keep me occupied. By buying a good domain name, that would probably give me the kick I need to do something with it!

</comment></comment></comment><comment><USER94> > I've been buying expired or abandoned domain names for a while, and enjoy > developing them into niche businesses.

Am I the only one here who has a problem with this kind of "business"? I see it as a very asshole thing to dedicate oneself to.

</comment><comment><USER95> This post makes good use of one of the 48 laws of power.

Law 30: Make your accomplishments seem effortless

<comment><USER96> What is your opinion of that book? I just looked up the summary of the 48 rules [1] and it seems pretty morally questionable. Maybe that's the point?

[1] [http://the48lawsofpower.com/summary](http://the48lawsofpower.com/summary)

</comment></comment><comment><USER97> This is awesome. Always great to read about someone's hard work and dedication paying off. I love a good onion, but am not within the 48 lower states, so unfortunately I'll have to wait for the international delivery option :(

</comment><comment><USER98> I loved this story, and you all clearly did, too.

How can I possibly be the first person to get stuck on the fact that this fellow dropped $2200 on a niche domain without a business plan in mind?

Most people don't have that kind of whimsy cash, sadly.

</comment><comment><USER99> I love this and can relate to it so much. This is very similar to how I ended up in the Japanese matchmaking industry. Noticed a good domain was available and ended up going on an odyssey of sorts.

</comment><comment><USER100> Bravo. I love his approach and his analogy with fictional characters. Such a wonderful way to view your work - stop trying to force it and let it tell you what it wants to be.

</comment><comment><USER101> Funny article. Like a lot of people I also collect domain names, some day hoping to make a business out of them. :)

My current business and startup take too much time, but some day..

</comment><comment><USER102> Had no idea when I clicked on that link that I'd be contemplating buying a box of onions. I've never tried a Vidalia but now I'm intrigued.

<comment><USER103> This is part of the marketing too, right? Reach more potential customers by writing an article and getting it to the top of a popular news aggregator. Especially with an audience that 1) will find it genuine, and 2) is likely to try out an interesting online product.

</comment></comment><comment><USER104> Boy did this article surprise me. Glad I clicked on this!

</comment><comment><USER105> Okay since no one has asked this yet, I will...does this man have an onion site?

Because I'm a big fan of onions, but an even bigger fan of onion sites...

</comment><comment><USER106> > I got along quite well with the 3rd farmer I met, so we decided to partner & > give this a shot.

Just curious, how were the first two farmers you met?

<comment><AUTHOR> They were all great, honestly. The first 2 had different operations. Farmer #1 would have worked, but they didn't have a packing shed. Farm #2 seemed ambivalent, so I was concerned whether my orders would go out on time.

</comment></comment><comment><USER107> This is posted in so many subs on reddit in the last 24 hours. Including unrelated subs. Please don't encourage spammers.

</comment><comment><USER108> That's a great story... And a perfect timing for an amazing marketing campaign with seasonal shipping starting next week.

</comment><comment> d--b Awesome post. I am dying to try these onions now!

Who would have thought that content marketing would work to sell onions through hacker news!!

</comment><comment><USER109> Seriously can't understand why this post is getting upvoted so much(2896) as of now. Is there something i am missing.

</comment><comment><USER110> I wonder about the domain name snapping business. Are there people doing this full-time, buying expired domains in bulk?

</comment><comment><USER111> What a wild ride. Can you give us more information about the boxes? I feel like I need to know more about the boxes.

<comment><AUTHOR> The box integrity entirely failed in-transit. Rips, tears, bottoms falling out, tops crushed, everything. I had to refund and re-send orders as make- goods, in better boxes. When my customers showed me pics of the box conditions after delivery, it made my heart hurt (no lie). I thought it was all over. These days, we send all orders in a double-walled cardboard box, with a locking bottom, and aeration holes throughout. It's a tank of a box.

</comment></comment><comment><USER112> My understanding was that the actual domain name doesn't make much difference? I setup [http://www.drivinglessonslimerick.com](http://www.drivinglessonslimerick.com) for a friend (I'm not a web dev) and it is on the second page of results when I search for Driving Lessons in Limerick. $2200 seems way too much, the value here is in this Onion business not the domain.

<comment><USER113> It's definitely the domain if you understand the clientele. I'm also from GA and old southerners are pretty particular which can be both good and bad. They only will search Vidalia Onions in google so having that domain + some good SEO definitely delivers them to you. I bet repeat customers still search that term instead of going directly to the domain.

Their benefit is that they love local things such as vidalia onions or boiled peanuts that they know are grown locally. I'd wager most of this guy's sales come from the south.

<comment><USER114> I don't think it's just old southerners.

I know quite of young people for whom Google basically _is_ the internet. They never enter addresses in the address bar, and always do a Google search for the site they're trying to get to.

These aren't dullards, either. They're smart people who are talented in their own fields. They're just not techies and the Googling-for-everything workflow works well for them.

</comment></comment></comment><comment><USER115> Unintentional ad, in a way —- one that caused me to visit, delighted me, and makes me delighted with HN.

</comment><comment><USER116> Feel sorry for the writer that Google Map folks some in and smash the whole onion field (last photo) :D

<comment><AUTHOR> I took that photo : ) and then uploaded to Google Maps...

</comment></comment><comment><USER117> Am I the only person who saw the headline and assumed this was about onion routing?

</comment><comment><USER118> What an incredible story. Encapsulates American entrepreneurial excellence !

</comment><comment><USER119> You just have to post here on the affect of a having this STORY on HN

</comment><comment><USER120> I thought this was going to be a new version of the onion router.....

</comment><comment><USER121> > I dropped in a bid around $2,200 'cause I was confident I'd be outbid. 5 > minutes later, I was the proud owner of VidaliaOnions.com

For those that are looking to replicate the success of this Vidalia Onion business only have a $10 budget for a domain here are some other options:

onlyvidalias.com

vidalias.net

tryvidalias.com

yummyonions.com

ordervidalias.com

buyvidalias.com

organicvidalias.com

vidaliafarm.com

allvidalias.com

simplyvidalias.com

<comment><USER122> SEO is more than just keywords in domain names, you're buying into a long-term investment. His domain cost $2200 because it likely had lots of backlinks and page rank in Google, which is how he was able to get 600 orders (about $30k in revenue if my math is right) in the first year.

It's also the perfect combination of the two keywords with nothing else. You'll automatically be at a disadvantage.

But every large market typically has 1 leader and 1-3 other smaller companies who can survive. I doubt this is a large enough market where being #2 or #3 is going to be lucrative. You might as well find other niche premium vegetables. Like 1-800-Flowers and Harry & David (which the author mentioned) does...

[https://www.wolfermans.com](https://www.wolfermans.com) made a decent-sized business selling premium english muffins.

<comment><USER121> It was a joke :)

<comment><USER122> Oh true. The author was also promoting domain name driven businesses [1] so I was mostly replying to that idea and other thoughts I had to sound off on the topic :p

[https://www.deepsouthventures.com/build-a-side- business/](https://www.deepsouthventures.com/build-a-side-business/)

</comment></comment></comment></comment><comment><USER123> 2396 upvotes and counting. How much more onions do you sell now? :)

</comment><comment><USER124> Cool image. Can drag / rotate it, etc., along at least 2 axes.

</comment><comment><USER125> Wonderful! This quote sums it all up for me: "I didn't have other projects that were this front-facing, customer wise. And I discovered I immensely enjoyed it". Wow, does it show :) By the way, the quote was not a TL;DR - <USER4> was an invitation to read a great story. I am glad I did.

</comment><comment><USER126> More detail on the cardboard shipping box debacle needed!

<comment><AUTHOR> see above : )

</comment></comment><comment><USER127> It's absurd and preposterous. I love it!

Late April: Season Begins.

</comment><comment><USER128> The title alone makes this worth reading.

</comment><comment><USER129> i like QA so much but i am a girl person . it is difficult for me and english is not good .what should I do?

</comment><comment><USER130> Wow! What an inspiring reading :)

</comment><comment><USER131> As Simple as peeling an onion.

</comment><comment><USER132> Love this.

</comment><comment><USER133> +1

</comment><comment><USER134> I just have to stop and say that this was an immensely fun and exciting post to read.

So much of the business stuff we read now is bullshit. It is stupid people getting lucky and riding on VC money while making more stupid decisions but ultimately dumping enough investor money into it that it works enough to get sold.

At which point, that founder then goes around and tells the same stereotypical story of dropping out of college, running out of money and getting investment on the day they were planning on giving up, etc. We have all heard the bullshit before.

So I was genuinely grateful to read a real business story. The owner saw an opportunity, took it when other people probably wouldn't have, and just genuinely worked hard to get where he is.

This is inspiring because anyone here could do it too if they wanted to. I don't mean selling onions specifically, but I mean they could just go out there find a product, work hard towards selling it, team up with manufacturers/producers, etc and make the dream come to life.

<comment><USER135> _> So much of the business stuff we read now is bullshit. It is stupid people getting lucky and riding on VC money while making more stupid decisions but ultimately dumping enough investor money into it that it works enough to get sold._

My impression (from way outside, I'm not an entrepreneur at all) is that so much business is VC-funded, which effectively means driven by finance people. Everyone who isn't a VC is still chasing a VC, so VC culture ends up defining business culture.

People, especially left-brained ones like programmers and finance nerds have this really bad tendency to see problems in terms of their preferred solutions. The old "if all you have is a hammer..." thing. So finance people like to turn everything into a money problem that they can solve using spreadsheets and Jupyter notebooks or whatever else it is they use.

Their ideal state is that "business" is just some board game where the money is all on the board already and you're just playing the rules to move it onto your square.

...which is of course completely antithetical to any kind of business that actually matters to real humans. If you want to actually solve a human problem, make peoples' lives better and maybe make a little money in the process, Silicon Valley business culture is increasingly useless to you.

<comment><USER136> If you want to understand how to make people's lives better, first you have to go out and actually _live_.

Scrappy college kids making a startup don't know how to live, they've just _barely_ lived. And a lot of professionals in tech have no lives outside of work and tech: Wake up and go work in tech. Go home and go read about tech. Attend a party and talk about tech.

How can we expect these Silicon Valley people to create anything that makes life better? All they can do is make cheap permutations of the same tired ideas that have passed through the lips of wanna-be gonna-be entrepreneurs for decades. Ask them: This product makes my life better? Better for what exactly?

Here's a man who understood that life is a bit better when you can bite into a tasty and juicy Vidalia Onion. This is something you can only know if you stop and take some time to _live_.

<comment><USER137> I'm reading this from the bus as the sun sets on 280, looking over south San Francisco. You're so right. I just quit my job so I can make furniture full time. Got accepted to a really good, niche school in a beautiful coastal town in the middle of no where I'm moving with my partner. I'm not going to miss this scene at all.

<comment><USER138> Would that happen to be Charleston? 10 years ago, a friend from South Carolina thought about doing an apprenticeship in custom furniture there but decided instead on his other dream job and became an Indy Car racing mechanic after completing a year-long course in the Jim Russell school up at Sonoma. He still talks about possibly getting into furniture, though.

<comment><USER139> Charleston, SC is my hometown and it's the most underrated city in the country.

<comment><USER140> The food scene in Charleston is amazing. I had a buddy who lived in Florence, and every six months or so I'd make the drive down to see him for an extended weekend. I'd never been to Charleston before and it blew my mind.

</comment></comment></comment></comment></comment></comment></comment><comment><USER141> This reminded me of an old friend from school. He finished high school and decided to work any type of job would land in front of him.

Meanwhile, his closest friends would finish school, go to colleges and universities and they would come back really proud for having a bachelor or masters degree.

One day they met at a crepe shop. He was making his orders along with the other folks that were behind their crepe pans.

"So...you work here mate?"

"Yep."

"Ah...shame. We make very good money, thanks to our _degrees_. Isn't a sad thing that you are forced to work in this shitty job?"

"First of all, I enjoy doing this job; and second of all, how much are you earning annually, if I may?"

"Around 35K euros".

He burst to hysterical laughter.

"I happen to make the least 1000 euros daily and this 'shitty job' happens to be mine; yep, I own the place. At my highest peak I earned 1 million euros and these guys you see working next to me are my employees which are getting paid more or less the same amount as you."

I happened to be there when this incident took place; it was the best day of my life! ^_^

<comment><USER142> Napkin math:

One million Euro a year gross would imply more or less 3000 Euro a day. Open for 12 hours a day, that's 250 Euro an hour. At 15 Euro a crepe, that's a customer every 4 minutes the whole day. That would be a truly phenomenal success.

And that's gross. If you assume 50% margin on cost (insanely high) and that cost includes the apparently very high employee salaries. Then they need a customer every two minutes for the day. Let's say taxes take half of their net before taxes. they now need a customer every minute for 12 hours every day of the year to hit a million Euro net. All under a series of assumptions that are extremely generous to the firm.

It's hard to imagine that this story, if true, didn't involve an embellishment of scale.

<comment><USER143> Here are some actual numbers from Austria for some comparable venues:

\- sausage kiosk average(!) turnover 180.000 € (sausages cost 2-3€, better kiosks make several times that easily)

\- small Subway €900k approx.

\- average McDonald's €3.2 mil

I'd imagine a decent crepes place the size of a McDonald's in a good location could easily make €2 mil/year turnover and half that much profit in a good year.

<comment><USER144> A 50% margin on food service is unheard of. That McDonalds is making 5-9% a year most likely, which is in line with food trucks generally.

<comment><USER145> Agreeing with you:

When I worked in food service long ago, the managers claimed the goal (of a Subway chain) was 30% gross margin. But that's gross margin, and doesn't account for overhead, and thus is not profit margin.

</comment></comment></comment></comment></comment><comment><USER146> Who... buys onions on the internet?

</comment><comment><USER147> While unique and somewhat gratifying that you can build a business with just a chance at a good domain and some internal motivations, do you find yourself adding value over other means of onion sales?

Oh, and please downvote. Thank you.</comment>


How To Safely Store A Password - <AUTHOR> http://codahale.com/how-to-safely-store-a-password <comment><USER2> Many developers need to read and understand this. It is far from mainstream knowledge...

The other day, I saw the following post about password hashing in my RSS feed: <http://isc.sans.org/diary.html?storyid=11110>

\- No mention of bcrypt (though the posts mentions key stretching using SHA1)

\- "When selecting an algorithm to hash passwords, it is important to select carefully as it is difficult to change the algorithm later. You will have to ask users to change their password if you do as you no longer know what password they picked." --> seriously? you can update the password the next time they log in...

\- _"You could also add a secret, in addition to the salt. If the secret is not stored in the database, it would not be easily reachable via a SQL injection exploit (yes, you can use them to read files, but it requires sufficient privileges)."_ \--> security through obscurity, nice

\- "For the paranoid, you may want to do the hashing on the client side (javascript) . This way, the server never receives the plain text password. We do this here for the ISC website on our login form [2]." --> oh noes...

Note that the blog has ~15k subscribers according to Google Reader...

\</comment><comment>---

I also launched a debate on StackOverflow the other day. A self-proclaimed "security expert" (he later edited his post to remove this part) was advising against using bcrypt, arguing that it would facilitate DOS attacks against the login page... He prefers security through obscurity, using a secret salt:

[http://security.stackexchange.com/questions/4781/do-any- secu...](http://security.stackexchange.com/questions/4781/do-any-security- experts-recommend-bcrypt-for-password-storage/4782#4782)

I thought it was a bad idea to leave this answer unchallenged, so I tried arguing with him. I was met with arguments of authority such as "Wow you are out of your element and could not be more misguided on this topic" or "you disagree because you don't understand. Show me an exploit you have written, then I'll pay attention to you.". Happily, some (more experienced) people got in on the debate. I hope this will help developers make an informed choice, if they stumble upon his answer...

(edit: list formatting)

<comment><USER3> I know very little about security, but is there something wrong with using a hash in the client side and then using bcrypt on the server so that you never receive the plain text password?

<comment><USER4> If the client sends hash(password) to the server, hash(password), for all intents and purposes, _is_ the password.

After all, an attacker does not need to recover the password from the hash, all he has to do is capture the hash and replay it.

<comment><USER5> I'm no crypto expert but wouldn't using a nonce allow this approach to work?

<comment><USER6> How would you check the nonce? All your server gets is a black box hash.

<comment><USER7> Not a security expert here.

Doesn't <http://en.wikipedia.org/wiki/Digest_access_authentication> do this? Also the server could store the nonce in a session.

</comment></comment></comment></comment></comment></comment><comment><USER8> I'd like to see sites offer the option of not using password-based authentication. Instead I'd like to see public key based authentication as an option.

Basically, the site would have a copy of my public key (say my GPG key or an ssh key), and to authenticate I prove that I have access to the corresponding private key.

<comment><USER9> You've just described SSL with client certificates. Works perfectly well, is extremely secure, and has an extremely bad GUI in pretty much every browser ever. (It's somewhat difficult to use "on the road", but that's arguably a security feature.)

<comment><USER10> I ponder the quality of the GUI is a testament to the frequency of the mechanism's use.

But the worse GUI is arguably better than no GUI at all:

<http://code.google.com/p/android/issues/detail?id=8196> and [http://stackoverflow.com/questions/357491/iphone-client- cert...](http://stackoverflow.com/questions/357491/iphone-client-certificate)

So, for the purposes of the growing mobile browser market (where having this would be the biggest benefit IMO), this is not applicable.

Which is a bit unfortunate.

</comment></comment></comment><comment><USER11> I have read this article and read the Wikipedia entry on bcrypt and I still cannot understand something. In this article it states that : "As computers get faster you can increase the work factor and the hash will get slower.". How can you make the algorithm slower over time and still be able to validate user passwords that were stored before you changed the speed? Could anyone enlighten me on this?

<comment><USER12> The easy way is to support the previous work factors and increase it next time the user logs in (since you'll have the password in plaintext in memory). Either way, bcrypt with a paltry work factor of 7 or 8 is orders of magnitude slower than md5 and sha. Jack that up to 12 or 13 and you're pretty much good to go for years, the only problem is the near 1-second processing time on semi-current hardware.

<comment><USER13> It's a hash function and, at least over an insecure connection, you should not be transferring the plaintext password from client to server so it's not guaranteed that you will have the plaintext password.

Assuming you're using a secure connection and you're willing to send plaintext passwords over it then yes, you could re-hash the password when a user logs in.

<comment><USER8> In any kind of scheme where all the server stores is some kind of hash of the password, how are you going to verify a password without sending the plaintext password to the server, so the server can compute the hash and compare against the stored hash?

<comment><USER14> You could do that with something called a Zero-knowledge password proof[1], of which SRP[2] is an example. As far as I know, SRP is patented. It is extremely clever, though.

[1] <http://en.wikipedia.org/wiki/Zero-knowledge_password_proof> [2] <http://en.wikipedia.org/wiki/Secure_remote_password_protocol>

<comment><USER15> To the best of my knowledge the SRP patents are not a big deal, and SRP is used in a number of commercial products. The bigger problem with SRP is that it's dangerous; it is difficult to screw bcrypt up, but it's very easy to screw SRP up; if you have to implement it yourself, dollars/donuts you're going to end up with an implementation that allows me to log in without a password.

<comment><USER14> I agree. I should just clarify that I'm all for bcrypt, having used it and recommended to friends/clients/employers. When I found out about SRP, I was researching on ways to do exactly what tzs asked, i.e., verifying a password without sending the plaintext (or plaintext-equivalent). In my case, the client had a login form that couldn't be placed behind SSL (don't ask why). Do you know of any solutions to this problem?

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Looks like Rails 3.1 is using bcrypt:

[https://github.com/rails/rails/blob/master/activemodel/lib/a...](https://github.com/rails/rails/blob/master/activemodel/lib/active_model/secure_password.rb)

<comment><USER17> So does Devise, one of the most popular authentication Ruby gems.

</comment></comment><comment><USER18> The article claims it takes bcrypt 0.3 seconds to hash a 4 char password on a laptop.

How does a server authenticate users in high volume with bcrypt? ~0.25 secs per auth request might warrant having a separate server just for authentication.

<comment><USER15> Several of the largest sites in the world have scaled bcrypt. There are longer answers as to why this is not a big deal, but if it helps to kill the red herring that bcrypt might not scale: Twitter uses it.

<comment><USER19> I'm really interested into the longer answer!

I'm sold on bcrypt but like to hear scaling stories :)

<comment><USER20> One possible, slightly longer, answer would be that "login" is a relatively rare operation in the grand scheme of things.

Users (usually) need to login only once per session. And on sites that have the little "Remember me"-tickbox a session may very well last for days or even months.

</comment></comment></comment></comment><comment><USER21> People keep posting this here. But I think <http://www.tarsnap.com/scrypt.html> should probably be considered the best way to do this today. Google is even using it in ChromeOS.

<comment><USER22> It is true that scrypt is better than bcrypt, but the transition from salt+SHA-1 to bcrypt is significatnly better than from bcrypt to scrypt, and scrypt doesn't have nearly as nice of an interface as bcrypt does.

<comment><USER23> The easy interface and wide availability of language bindings to bcrypt is a big deal. The easier it is to use, the more likely people are to use it, and the less likely they are to mess it up. Scrypt isn't quite there yet, and bcrypt is still very good.

</comment></comment></comment><comment><USER24> I am surprised nobody had already talked about scrypt yet. Here is an old hackernews entry about it.

<http://news.ycombinator.com/item?id=601408>

I would have loved to use scrypt, but there is only a C implementation. I would had loved to have at least a javascript one.

<comment><USER9> Javascript? Have fun securing that one against timing attacks. Also, it's so much slower than the C implementation (remember that crypto algorithms are very carefully designed for 32- or 64-bit words or arbitrary-length integers; Javascript's doubles are a _very_ poor match.)

<comment><USER25> Timing attacks are not a problem if you're using it to hash passwords. Also, Javascript implementations don't use doubles for pure integer arithmetic.

<comment><USER9> If I can observe your (SSL-encrypted) login session, I can time how long the server takes to process your (presumably real) password. What makes you think password hashes don't need to worry about this?

<comment><USER26> Would you really be able to do timing attacks on a server from the client side? I thought you needed a much greater accuracy of measurement, sub- millisecond, than you would be able to achieve with network latency in the mix.

<comment><USER27> Apparently it can be done.

<http://www.cs.cmu.edu/~dbrumley/pubs/openssltiming.pdf>

</comment></comment></comment></comment></comment></comment><comment><USER28> It's good to raise awareness of this issue. When more devs began using bcrypt or scrypt, offline password cracking will be much, much more difficult.

The only reason GPUs are cited as testing 600 million hashes a second is that the underlying hashes came from a Microsoft Windows Active Directory where they were simply MD4 encoded. That speed is not possible with bcrypt. Devs need to understand this.

Edit: Yes, that's MD4 not MD5. Microsoft Windows NT hashes are simply Unicode strings that are MD4'ed. This includes Windows 7 and Windows 2008 server.

<comment><USER29> And note if you already have this hash you can use it to login directly anyway as most Windows network protocols take this hash directly. The real important thing IMO is NTLM challenge/responses based on the hash, which unfortunately is not much better. In case of NTLMv1/MS-CHAP it is three 56-bit DES operations on separate parts of the 128-bit hash (the third being only 2^16 so it is easy to precompute, as shown by asleap). NTLMv2's HMAC-MD5 is fast too.

</comment></comment><comment><USER30> Honest question. Why would someone who handles more than a couple-dozen login attempts per second choose to use bcrypt? It would seem that the computational overhead of supporting bcrypt at scale would not make a lot of financial sense.

<comment><USER31> You can change the work factor to scale the amount of time it takes to do the processing. Beyond that, there's a cost to security. If you actually need security, you may need to pay for it. How much is it going to cost you to buy an extra server vs the loss of business due to a serious security breach?

<comment><USER30> In the court of public image, simply loosing the data in the first place will cost you business, now matter how secure that data may be. The trust to secure your data will be lost, regardless of whether you used bcrypt or sha or plaintext.

If you consider the loss of business to be pretty much constant in the event of a loss of control of the customer's data, what is the value of extra server(s) (plus the cost of maintenance) for one of the least valuable pieces of information a customer can give you?

As an example, look at Instapaper. How many people are more concerned that the government has access to their sha1 encrypted passwords as opposed being concerned that the government has free access to their reading history?

<comment><USER31> For sure there's going to be loss of confidence either way. You're probably going to have a bigger loss if the security experts are pointing out that you couldn't even get password storage right, though.

Obviously they It's up to you whether you care enough about your customers to try to get security right. You gave a reasonable argument for why using bcrypt instead of md5 makes little financial sense. However, that same argument applies to plaintext vs hashed. Or hashed vs hashed with salt. In the end, you need to decide how much you care about security, and also weigh how much security you are morally obligated to provide.

<comment><USER30> Plaintest vs. hash, or salted hash vs. salted hash do not incur the same performance penalty.

And while I may feel morally obligated to provide great security, the people I report to would not be as impressed with that in a cost-benefit analysis.

tl;dr It's a great idea, but a tough sell, particularly at scale.

<comment><USER31> My hashed/unhashed comparison was not a performance statement, but a trust statement. If a breach will lose the same amount of confidence regardless of password storage, why bother with even hashing?

I can't imagine how "good security - scalable enough for Twitter" can be a hard sell. Your customers certainly won't by sympathetic if they learn that you willfully chose weaker security to save a buck.

</comment></comment></comment></comment></comment></comment><comment><USER32> Can someone help me understand what a password cracker does with a list of salted/hashed passwords? How do they know they've figured out the right plain text passwords without bouncing them against the authentication logic?

<comment><USER33> i suspect you don't know that the salt is stored with the password [edit: when using standard libraries like crypt and bcrypt - please don't invent your own scheme]. so when someone steals the password list they get the salt too.

the salt is not "secret" - it is stored in plain text for each password. it does not need to be secret to do its job (defend against rainbow tables).

<comment><USER34> _Sometimes_ the salt is stored with the password. I sometimes see having a hardcoded salt referred to as 'security by obscurity', but considering that many attacks result in just a database dump, not giving attackers access to (at least part of) the hash is a useful security layer.

</comment></comment></comment><comment><USER35> The real question should always be how you detect and handle these attacks. Allowing someone to attack your service for 12 years and eating up your resources in the meanwhile just sounds too passive a solution.

<comment><USER22> That's not the attack you worry about: instead, consider the case where someone somehow obtains the database and can do an offline attack on it. Be it a SQL injection or account compromise (or sheer negligence and publishing the database), once that happens you'd better handle passwords reasonably well.

If the only attack situation you're worried about is a online guessing attack, then there's no need to even hash passwords.

<comment><USER35> Sounds to be the case, thanks for the tips.

</comment></comment></comment><comment><USER36> What always annoys me with the discussion of passwords is that everybody here focus on a technical solution that allows the user to continue to use insecure passwords.

That isn't the problem. Reuse is. And the best way around that is to not let the user select the password, just generate it server side. Technically this is easier to get right than some complex password generation scheme and the end result is properly better too.

<comment><USER37> Reuse is a problem, but weak passwords are the biggest problem. If you have a strong password that never gets cracked/leaked/intercepted but you use it everywhere you're still fine, but that's not recommended.

Generating server-side passwords is horrible as well since you're counting on the user to write it down and/or let the browser's password manager save it. What if the user wants to log in with a different machine/browser?

I think the best solution is to, first, forbid passwords under 10 characters. 8 is still relatively secure, but not really, 10 at least gives you a fighting chance. Second, run your own dictionary attack (you can load /usr/share/dict/words into a hashtable and check for membership in sub-second times..in fact, here:

        import sys
        f = open('/usr/share/dict/words')
        words = {}
        for line in f:
          words[line.replace('\n','')] = None

        if sys.argv[1] in words:
          print 'You fail'

) and alert the user if their password sucks and to pick a new one. (You might want to check for membership of their password with an 's' or a '1' or something added on as well.) You might also want to do some sort of complexity analysis as well that requires e.g. at least one uppercase, one lowercase, one number.

The infrastructure problem is places like Banks saying "Enter a password between 6 and 12 characters and only use alphanumeric characters!"

<comment><USER38> Eight characters for a password seems plenty long to me, if you're truly using a random password. You have [A-Za-z] = 52 chars, [0-9] = 10, [!@#$%^& _()_-+=;':",. <>/?\|[]{}] = 30, for a total of 92 possibilities. Then you have an 8 character password. Even if the attacker knows you're using 8 characters, you've got ((92^8)_0.3)/60/60/60/24/365/100 = 271 centuries if it takes 0.01 seconds a try. And we're really talking over 8 thousand centuries if we're having bcrypt take 0.3 seconds.

So the problem is that passwords tend not to be random. This greatly decreases the problem-space. But b/scrypt solves the problem of length, within reason.

<comment><USER39> I fully agree, but I'd focus more on the length than on the character set. It is not a problem if the password contains only alphanum characters, as long as those are random.

For instance, a plain alphanum password of length 9 is stronger than a password of length 8 that allows for special characters. (because 62^9 > 94^8)

In other words, adding one character to your password is as good as choosing from a bigger character set.

Okay, beginning at length 10, you'd need to add two characters, but that's really all you need to do up to length 20. (which is an insane length for a random password anyway)

<comment><USER37> C^x grows a lot faster than x^C, except for specific x's and C's you're almost always much better off adding to the length. And 20's nuttin'. At the risk of publishing more hastily written code for critiquing, here's a shell script password generator I use sometimes. <https://gist.github.com/1058565>

</comment></comment></comment></comment></comment><comment><USER40> Let's say I use bcrypt and want to increase the work factor every year. Is it possible to determine the work factor of an existing hash, or will I need to maintain this information alongside the hash? The java and python bcrypt APIs don't have any function that returns the work factor.

Can I increase the work factor of an existing hash, or must I wait until the user logs in and then use the plaintext password to generate a new hash?

Is there a bcrypt API that provides a hash comparison function that addresses timing attacks? The py-bcrypt example code uses the '==' operator to compare hash strings, leaking timing information:

        # Check that an unencrypted password matches one that has
        # previously been hashed
        if bcrypt.hashpw(password, hashed) == hashed:
                print "It matches"
        else:
                print "It does not match"

(from <http://www.mindrot.org/projects/py-bcrypt/>)

<comment><USER40> To answer my first question, the work factor can be extracted from the hash. It is stored as a 2-digit decimal number in the fifth and sixth bytes of the hash. See [http://code.google.com/p/py- bcrypt/source/browse/bcrypt/bcry...](http://code.google.com/p/py- bcrypt/source/browse/bcrypt/bcrypt.c#141)

</comment></comment><comment><USER41> I recently put together a commentary + code on how to upgrade passwords hashed insecurely in your DB without user intervention. This was in response to MtGox talking about "slowly migrating users", which presumably means upgrading passwords at the point of login:

<https://gist.github.com/1051238>

<comment><USER42> If I'm not misunderstanding your purpose, why not just:

1) Take those md5 unsalted passwords and 2) bcrypt them

Then upgrade the users to non-pre-hashed bcrypt as they log in?

?

<comment><USER41> Why do you think that isn't what this is doing, only with fault tolerance to allow more than one scheme upgrade?

<comment><USER42> Because the juicy bits got cut off due to the way github is displayed on my phone. Sorry I couldn't see that portion!

</comment></comment></comment></comment><comment><USER43> In security the most important thing you can teach people is to be aware when things are harder than they look so they'll take a bit of extra time educating themselves and talking to other people.

Learning how to separate good from bad advice is a skill that needs to be maintained. Also, in all software that is supposed to provide some form of security, one has to be prepared for the eventuality that it probably contains errors.

I used to read a lot of books on cryptography and the use of cryptography. I've forgotten most of it by today, and to be quite frank: the more I know, the less I want to write crypto software. There is something deeply unsatisifying about work where you know that what will in all likelihood trip you up is some trivial, stupid mistake.

It isn't hard because of the crypto itself. Sure, certain cryptographic libraries can be extremely awkward to use (which in itself is a security risk), but the problem usually comes from where you aren't looking for them.

I cringe a bit when people advertise software as being secure because it uses this or that encryption scheme. I also cringe when people claim that they "encrypt databases" and their systems are therefore secure -- because, for most usage scenarios, I can't think of any really secure way of doing this. Not without compromises anyway. And while I honestly know that I have just a rudimentary grasp on cryptography, I know a lot more about it than most people who make products that hinge upon correct application of crypto.

Just the other day I was trying to determine how many rounds I wanted to use in bcrypt for storing passwords for a given system. I think I spent most of the day pondering this question, writing benchmarks and reading up on what other people said on the topic. A couple of days later a friend of mine emailed me a code snippet that implemented the password hashing scheme of a commercial product they use that makes shameless claims about being secure. (I think he probably just looked at the hashed passwords and made a guess about the method they had used. I don't think he had a look at the original source code). If memory serves the product uses unsalted SHA1 hashing. In other words, the vendor didn't even bother thinking about the problem.

What scares me a bit is that even I thought "well, if they claim to have well thought-out password handling and they are in the business of selling security systems, I suppose they have probably given this a lot of thought" the first time I visited their website. After all, large companies give them millions. Right?

I wonder what other things they are doing equally badly.

</comment><comment><USER44> Does anyone know how Djangos built-in password hashing fares?

<comment> brown9-2 Looks like the built in stuff uses either sha1, md5, or crypt: <https://docs.djangoproject.com/en/dev/topics/auth/>

<comment><USER45> <http://code.playfire.com/django-bcrypt/> Backwords-compatible bcrypt support.

</comment></comment></comment><comment><USER46> Previous post: <http://news.ycombinator.com/item?id=1998819>

Similar discussion: [http://chargen.matasano.com/chargen/2007/9/7/enough-with- the...](http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow- tables-what-you-need-to-know-about-s.html)

</comment><comment><USER47> To see if I understand bcrypt correctly, would this pseudo code achieve a similar adaptable computational cost?

      function(uniqueSalt128Bit, password, rounds) {
        var hash = SHA1(uniqueSalt128Bit + password);
        var length = Math.pow(2, rounds);
        while (length--) hash = SHA1(hash);
        return hash;
      }

<comment><USER48> This is similar to SHA512 crypt: [http://packages.python.org/passlib/lib/passlib.hash.sha512_c...](http://packages.python.org/passlib/lib/passlib.hash.sha512_crypt.html)

</comment></comment><comment><USER49> Or a stretched newer algorithm like Whirlpool. Or stretched SHA-256? What advantages does bcrypt have over them?

<comment><USER50> It's been around for years and remained solid. It's implemented in every language under the sun. It can be tuned to be _plenty slow_ , even today.

That said, there's nothing wrong with choosing another password derivation scheme. glibc's crypt() provides _three_ : PHK's MD5 scheme, and Ulrich Drepper's stretched SHA-{256,512}. Just don't roll your own and you'll be ahead of the majority of programmers.

</comment></comment><comment><USER51> What properties of bcrypt make it better than SHA-512 with more iterations to make the time taken to process it equivalent? Is there something about the algorithm that makes it more difficult to speed up via GPU/hardware?

</comment><comment><USER8> Why not PBKDF2?

<comment><USER15> PBKDF2 is fine. bcrypt has better library support. I'd rather you used a bcrypt library than try to roll your own PBKDF2.

<comment><USER52> bcrypt is also slightly stronger than PBKDF2, since it requires a larger circuit to compute.

The only reason you would want to use PBKDF2 is if (a) you already have a hash and don't want to add blowfish to your code/circuit, or (b) you want to be standards-compliant.

</comment></comment></comment><comment><USER53> Now, how do I explain to my girlfriend that picking longer, more complex passwords is a realistic security precaution and that I'm not just a paranoid nerd?

</comment><comment><USER54> For PHP users, phpass is a really nice password library. <http://www.openwall.com/phpass/>

<comment><USER55> Shameless plug for PHP devs: <https://github.com/SaltwaterC/PasswordHash2> \- you may like this as well.

</comment></comment><comment><USER56> What work factor do you recommend to make it reasonably fast and still bruteforce-proof with the current HW?

</comment><comment><USER57> So I assume if you use bcrypt, you only verify the password once upon login, and then store a cookie that verifies the user is logged in? That brings other security risks.

But the alternative seems to be to make every request very slow, because it would require bcrypting the password with every request.

<comment> brown9-2 If you were to re-authenticate the user on every request, how do you have the client send the password to the server on every request without making the user enter it every time?

<comment><USER57> By storing it in a cookie - oh :-)

I suppose you could come up with some scheme where you create a new cookie with every request, a kind of one-time cookie to prevent session hijacking. Probably not worth it and not 100% reliable, though.

I guess just trusting in cookies is the only real option.

Or HTTP BasicAuth, it sends the password with every request I think (unencrypted, I know). In either case in theory you need HTTPS.

<comment><USER58> Oh man, please tell me I'm misreading you, and you don't actually store your users' usernames and passwords in a cookie.

<comment><USER57> No of course not. I mean yes, you misread me.

</comment></comment></comment></comment></comment><comment><USER55> <http://www.openwall.com/lists/announce/2011/06/21/1> \- some bcrypt implementations out there are still broken if they used this code. You may give the SHA-based scheme a chance.

</comment><comment><USER59> bcrypt is so flawed...

<comment><USER60> If you want to stand by that assertion, please provide some information to back it up. You'd become very popular in this community (and the security community at large) if you could provide a good basis for that statement.

Otherwise, you're just trolling, and I've committed a cardinal sin.

</comment></comment><comment><USER61> and/or stop using a single word and use sentences (phrase)

eight characters is easy - try cracking 50

<comment><USER62> Not too difficult if it's composed of dictionary words. Why not automatically generate random strings to use? No pattern at all.

<comment><USER63> with cuda and the cloud it's quicker to try all possible passwords (starting with aaaaaaa...) than to search a rainbow table of dictionary words so ":Hy6&z@z" is now no more secure than "password"

<comment><USER62> Rainbow tables don't apply to salted passwords.

<comment><USER64> But you can still do a brute force attack--that's part of why SHA1 has some issues--you can beat it with brute force and enough GPUs.

</comment></comment></comment></comment></comment><comment><USER65> You can add the configurable slowness factor to any secure hash. Just use salts but leave out k bits from each when storing them. The more bits you leave out, the more work it takes to verify a password as the verification procedure needs to brute-force the missing k bits.

<comment><USER66> You can also write a new cipher, discover a new key derivation function, and invent a new hash function. But that's not the point. Use bcrypt or scrypt.

<comment><USER65> Any analogy between using a standard technique with a standard hash and going for DYI cryptography is a bit stretched.

<comment><USER66> Really? You just described a KDF, and advised people to use it without providing any references to implementations. "Just leave out k bits of salt and brute-force it" -- do you really expect non-cryptographers to be able to correctly implement this algorithm? If you insist on using hashes, at least you could tell people to use PBKDF2 to turn a standard hash into KDF.

</comment></comment></comment></comment><comment><USER67> Another thread where seeing Karma would really help...

Maybe it should be optional?

<comment><USER68> If karma is needed to judge the quality of someone's post, then the karma counts are probably inaccurate anyway. At best they'd be interspersed with votes by people who just thought the answer sounded good without really knowing how accurate and informed it is. At worst, the majority of the votes would consist of that type.

HN is better without karma, just think of it as a place to find out about concepts you might not have been aware, then drill down on it with some more trusted source.

</comment></comment><comment><USER69> the weaknews is actually storing the salt or code or key with the password. using bcrypt helps a bit but doesnt truly solve the issue. i think thats important to point out. sha1 with a salt u cant find beats bcrypt with a key u know any day

<comment><USER22> No. Not at all.

If someone managed to break in to your website and get the password hashes, chances are they also have your "secret" salt. There is _no_ reason to separate the salt from the hash, and, in fact, there are no implementations which do that.

However, if I can't convince you of that, then if you ever make a website that takes passwords, please use bcrypt. You can do your super-special-salt- separation-scheme, but just use bcrypt instead of SHA-1.

<comment><USER65> _"If someone managed to break in to your website and get the password hashes, chances are they also have your "secret" salt."_

I believe the GP was referring to the scheme where you don't store the salts at all (or only store some bits of each salt.) The verification needs to brute-force the salt (or the missing bits) each time it verifies the password.

The missing bits are quite similar to the bcrypt workfactor - the more you leave out the harder it is for both the attacker and the legitimate verification to verify passwords.

<comment> brown9-2 Then how in the world does your code know what salt to use when the user presents his or her password?

If it is derived in code from some other piece of user data then it is still "known" if your DB leaks - you have to assume someone who stole your database also stole your code.

<comment><USER34> "you have to assume someone who stole your database also stole your code."

Maybe, but that doesn't mean that a separate salt, not in the database, will prevent certain attacks, and as such is a viable option. Security is about layering, not about 'xyz isn't 100% secure in 100% of the cases, forget about it'.

<comment><USER50> That's fair, but it doesn't change the insanely wrong statement that triggered this comment chain:

"sha1 with a salt u cant find beats bcrypt with a key u know any day"

This is _fractally wrong_.

<comment><USER34> OK then we agree there :)</comment></comment></comment></comment></comment></comment></comment>


Wall Street bonuses fell 9% in 2015 as profit slipped - <AUTHOR> http://www.marketwatch.com/story/wall-street-bonuses-fell-9-in-2015-as-profit-slipped-2016-03-07 <comment><AUTHOR> It's nice to know so many souls can be sold for an average of $146,200 in 2015</comment>