3 ms·

from the bcrypt page: the other [bit of terrible advice] recommends reversible encryption, which is rarely needed and should only be used as a last resort. Why

• pudquick 17y ago
  Because it means with <single piece of secret info>, your entire customer base's worth of passwords is now decrypted. You've now gone from "Even if we get attacked, we've chosen a provably difficult / secure storage method. The damage should be negligible." to "If we get attacked - I hope like hell they don't get <single piece of secret info>." An attack is an attack. If they can get in and steal your password database, what's to say that they can't get access to the key that decrypts your reversible database?
• deleted 17y ago
  [deleted]
• run4yourlives 17y ago
  Essentially, because it is reversible. In other words, the information needed to extract the true raw-text password is actually included in the encrypted string. With a hash, only a representation of the raw-text is being stored. Even if you knew exactly what was done to create that representation, you're still a long way off from understanding the raw-text. If you treat both the key and the salt as being "known to the developer only" and either of these becomes compromised, you still don't have they raw-text of a hash, but you've got everything you need for the encrypted.