3 ms·
"pathetic" is a bit harsh. Yes, one should be using b/scrypt nowadays but at least he's using salt and sha256 it's not md5. It could be better, but it could als
by vruiz 11y ago
"pathetic" is a bit harsh. Yes, one should be using b/scrypt nowadays but at least he's using salt and sha256 it's not md5. It could be better, but it could also be much worse.
- iancarroll 11y agosha256 is not "better" than MD5 for password hashing; they're both incredibly fast to brute force and both not meant for password hashing. bcrypt/scrypt, configured correctly, are much slower and much more secure.
- feld 11y agosalt adds a minor hurdle and that's it.