3 ms·
That's kind of the point; if you're worrying at all about salts in your login code, you're using a crappy algorithm. If you're using a decent algorithm, it tak
by Semiapies 11y ago
That's kind of the point; if you're worrying at all about salts in your login code, you're using a crappy algorithm. If you're using a decent algorithm, it takes care of the salts.
- InclinedPlane 11y agoSort of a catch-22 though. On the one hand you want all of the important details about your password "encryption" system to be handled by more competent people (read: cryptographic experts). On the other hand, without an understanding of the details you will be too ignorant to tell the difference between a good and bad algorithm and in whom you can entrust such implementation specifics or not. Additionally, one might say "well, just follow industry best practices", but that is based on the idea that "use bcrypt/script" is such, but it's not. The "best practice" as defined by the industry at large is mostly just to use MD5, maybe with a salt, because that's what "everybody else is doing".