5 ms·
Bad idea to use bcrypt.hashSync in Node.js. I hate that so many tutorials use that one instead of the correct bcrypt.hash with a callback. This is Node.js for t
by jtwebman 11y ago
Bad idea to use bcrypt.hashSync in Node.js. I hate that so many tutorials use that one instead of the correct bcrypt.hash with a callback. This is Node.js for that 200 ms where you are hashing that password nothing else runs, no requests, everything stops. Here is the correct way to use bcrypt in Node.js:
bcrypt.genSalt(10, function(err, salt) {
if (err) return; //handle error
bcrypt.hash(clearPassword, salt, function(err, hash) {
if (err) return; //handle error
// Store hash in your password DB.
});
});
- dsp1234 11y agoNote that bcrypt.hash just calls bcrypt.hashSync anyways[0]. So there it's still going to stall exactly the same amount. edit: Looks like it depends on which version you use. 'npm install bcrypt'[1] gives a version which supports true async usage (via V8 async callbacks in native code) 'npm install bcrypt-nodejs'[2] gives a pure JS version which I linked to. Which is the top search result for 'nodejs bcrypt' [0] - https://github.com/shaneGirish/bcrypt-nodejs/blob/master/bCrypt.js#L630 https://github.com/shaneGirish/bcrypt-nodejs/blob/master/bCr... [1] - https://www.npmjs.com/package/bcrypt https://www.npmjs.com/package/bcrypt [2] - https://www.npmjs.com/package/bcrypt-node https://www.npmjs.com/package/bcrypt-node [3] - https://www.google.com/search?q=nodejs+bcrypt https://www.google.com/search?q=nodejs+bcrypt
- __abc 11y agoBUT NODE.JS IS NON BLOCKING?!?@?!?!?! Kidding.
- EGreg 11y agoIt's IO-bound. I guess they could make a version that yields and resumes several times though!
- novaleaf 11y agolol at pure js KDF's
- novaleaf 11y agowow that's some serious downvotes. Why? a 1 second KDF function on a GPU will take upwards of a minute in javascript ... and conversely a 1 second KDF in Javascript will be trivial to crack brute force. There is no point in it.
- Klathmon 11y agowhere are you getting those numbers from?
- novaleaf 11y agomy own testing. maybe not a 1 sec to 1 minute factor though. see my other reply in this thread a few seconds ago.
- minitech 11y agoI just measured it, and native bcrypt seems to be about 5× as fast as bcryptjs. As long as the time for one hash is more than 0.0001 s, you’re doing pretty well as far as password storage goes, so a pure JavaScript bcrypt is bad mostly because it’s blocking on Node and not because it’s too slow to be useful. Please don’t pull numbers out of nowhere.
- novaleaf 11y agowhen I was figuring out password security I did some tests. on my phone (a galaxy s3) I got about a 40x slowdown of pbkdf2 versus an x86 server running a compiled version (C I assume). I suppose running the js version on a server might give a better runtime, but I'd think the point of a js KDF is to run on the client, not the server. edit: and I'd assume a GPU version would be faster.....
- dsp1234 11y agobut I'd think the point of a js KDF is to run on the client, not the server. bcrypt is used on the server (node.js) to hash a user's password before storing it in the database. Then later, when a login is done, the password from the login is checked against the stored hash to see if the match (and by implication, that the original passwords are the same). So the usage is mostly on the server as expecting a client such as a mobile device to do large rounds of CPU intensive work just to login isn't going to make for happy customers.
- warfangle 11y agoAnd 'npm install bcrypt' is the package linked to from the article.
- mbell 11y agoThe project from the article is https://github.com/ncb000gt/node.bcrypt.js https://github.com/ncb000gt/node.bcrypt.js There, the encryption is handled asynchronously, the event loop is yielded while the calculations take place in a C extension.
- joepie91_ 11y agoMore specifically, any functions that end in Sync should be avoided. Unfortunately a lot of people think that these functions are a simple way to "not have to deal with callbacks", which is not correct...
- Zarel 11y agoIt's not correct? Is there any reason not to use the Sync functions if you're not writing a web server and don't particularly care for performance?
- joepie91_ 11y agoIt is indeed not correct. They are not functionally equivalent to their asynchronous equivalents at all - your entire event loop will be blocked for the full duration of the operation. This may sound like "not a big deal", but even an operation that takes 1ms will cause noticeable lag at ~50 operations per second, and block everything approaching a thousand. For emphasis: they block the entire event loop. Not a single request, not a single client, not a single operation or event. The entire application for every user everywhere.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- swang 11y agoIf it's your own thing, do whatever you want. But the only thing sync should be used is to exec shell scripts in node.js. sync functions are bad otherwise in any kind of production environment.
- sarciszewski 11y agohttps://paragonie.com/blog/2016/02/how-safely-store-password-in-2016#nodejs https://paragonie.com/blog/2016/02/how-safely-store-password... How does that look now?