3 ms·

Doing things the right way is not very illustrative. This isn't meant to teach developers how to reinvent NaCl in $langOfChoice, it's meant to instill an unders

Doing things the right way is not very illustrative. This isn't meant to teach developers how to reinvent NaCl in $langOfChoice, it's meant to instill an understanding of the vocabulary. If nothing else, it aims to put to rest stupid phrases like "password encryption". If people copy&paste despite all the warnings, they're beyond the help of any blog post. EDIT: In the spirit of being more helpful, I've added links to more complete sample code (on StackOverflow) and made the warnings less obnoxious.

mckiddy 11y ago
In that case they should just leave out the examples entirely. If the code runs, someone in the world WILL copy & paste it into their project and walk away, no matter if it's marked as insecure or not, which just perpetuates the problems that the post is trying to deal with. Also I'm not sure "password hashing" is any more descriptive than "password encryption."
- sarciszewski 11y ago
  > In that case they should just leave out the examples entirely. I'll consider it. > Also I'm not sure "password hashing" is any more descriptive than "password encryption." It absolutely is. Encryption is a two-way transformation of data. It is, by design, reversible. Hashing is one-way. Password hashing is a special case of hashing where you want it to be computationally expensive (even with special hardware at your disposal) to attack, but still perform well enough to interact with. Password encryption implies that a two-way transformation has taken place, and given the key, you should be able to reverse it. This is not within the scope of the requirements for secure password storage.