4 ms·
People need to read this article very carefully before forming any sort of take-aways. The title and the start of the article suggest that salts are irrelevant
by nostromo 11y ago
People need to read this article very carefully before forming any sort of take-aways.
The title and the start of the article suggest that salts are irrelevant. Then only a few paragraphs later, the author states that salts are indeed crucial.
Later in the article, we learn that this article isn't really about salts at all, but the importance of a high work factor / rounds.
The problem with the way this article is presented is that a casual reader will be left with the idea that salts are no longer important, which is false.
A better title would be something like, "Salts are important, but so is a high work factor"
- tptacek 11y agoCareful. Salt quality is almost totally unimportant. And there are no well-known, well-reviewed password hashes that aren't randomized. The lesson I'd take away from an article like this is: "don't DIY your password hash". Historically, every discussion I've seen that tried to acknowledge the "importance" of salts devolved into people defending their DIY "secret-salt" schemes. "Important salts" seem like an invitation to reject bcrypt, scrypt, and PBKDF2. I think part of the problem is the term. I think we should stop talking about "salts", and instead just say whether a given password scheme is randomized or not.
- markdown 11y agoGoogle AppEngine is part of the Google Cloud Platform. It's a pretty big deal. If you want to use it, (at least with Python) you need to roll your own. You can't upload scrypt, bcrypt or PBKDF2 with your app, since code with C isn't kosher on there.
- sdevlin 11y agoIsn't PBKDF2 in the stdlib as hashlib.pbkdf2_hmac?
- bjterry 11y agoGoogle has had support for PBKDF2 in PyCrypto since around August 2012[1]. 1: https://code.google.com/p/googleappengine/issues/detail?id=5303 https://code.google.com/p/googleappengine/issues/detail?id=5...
- ketralnis 11y agoI use pbkdf2 in GAE
- masklinn 11y agoPBKDF2 is easy to implement in just about any language: https://github.com/mitsuhiko/python-pbkdf2/blob/master/pbkdf2.py#L58 https://github.com/mitsuhiko/python-pbkdf2/blob/master/pbkdf... The Python stdlib also provides a pure-python implementation if OpenSSL >=1.0 isn't available: https://hg.python.org/cpython/file/2.7/Lib/hashlib.py#l163 https://hg.python.org/cpython/file/2.7/Lib/hashlib.py#l163
- wolf550e 11y agohttps://jbp.io/2015/08/11/pbkdf2-performance-matters/ https://jbp.io/2015/08/11/pbkdf2-performance-matters/ https://github.com/Ayrx/python-fastpbkdf2 https://github.com/Ayrx/python-fastpbkdf2
- derefr 11y agoThe right way to say it is, I think, "all modern password libraries do the salting for you. Use one, and stop trying to outsmart it."
- UnoriginalGuy 11y agoOr to phase it another way: The article is extremely poorly written and attempts to be edgy by suggesting something unconventional only to then roll it back entirely just a few paragraphs later. The whole thing can be distilled down to: "Make sure you're using a modern hashing algorithm, and pay attention to the work factor." It actually has nothing interesting to say regarding salts and or peppers that hasn't been said a million times before.