3 ms·
How? Basically, it’s slow as hell. Is that it? bcrypt is good only because it is slow? In that case, why don't we use whatever we like (MD5, SHA1, SHA256, SHA5
by oozcitak 17y ago
How? Basically, it’s slow as hell.
Is that it? bcrypt is good only because it is slow? In that case, why don't we use whatever we like (MD5, SHA1, SHA256, SHA512, SHA-3, etc) and add a sleep(500); just before the call? It is guaranteed to keep up with Moore's law as well!
- rimantas 17y agoDid you read the article? The problem is that someone trying to bruteforce your MD5 hash won't add that sleep(500). Bcrypt is slow by design.
- oozcitak 17y agoI thought the attack was against the application. The article talks about the security of the raw data in the database. I missed that on my first read. Sorry for that.
- sordina 17y agoI hope you're being sarcastic, but if not, it is because an attacker could take out the call to sleep(500) again.