4 ms·
Furthermore, bcrypt, scrypt and the rest all have a salt. They just serialize it into the password along with the work factor etc.
by willvarfar 11y ago
Furthermore, bcrypt, scrypt and the rest all have a salt. They just serialize it into the password along with the work factor etc.
- Semiapies 11y agoThat's kind of the point; if you're worrying at all about salts in your login code, you're using a crappy algorithm. If you're using a decent algorithm, it takes care of the salts.
- InclinedPlane 11y agoSort of a catch-22 though. On the one hand you want all of the important details about your password "encryption" system to be handled by more competent people (read: cryptographic experts). On the other hand, without an understanding of the details you will be too ignorant to tell the difference between a good and bad algorithm and in whom you can entrust such implementation specifics or not. Additionally, one might say "well, just follow industry best practices", but that is based on the idea that "use bcrypt/script" is such, but it's not. The "best practice" as defined by the industry at large is mostly just to use MD5, maybe with a salt, because that's what "everybody else is doing".