Hi, i explained our reasons in replies to other posts, i think they are if not good, at least worth considering. quote: There's no argument from me regarding

Hi, i explained our reasons in replies to other posts, i think they are if not good, at least worth considering. quote: There's no argument from me regarding undesirability of keeping the passwords. But we also have a different concern - we don't want to be in the business of authentication at all - our goal is to have a third party service or appliance performing authentication and forwarding us already authenticated sessions with the user name as a header, for instance. Our desired end-state - is when we do not have any knowledge of or access to credentials used by the end-user. To enable us to make this transition possible - for the time being we store the passwords, since as i explained in another reply, we must make this transition transparent to the users and we have legitimate users that login once a year (think credit report, just an example, not our business), so we can't intercept the credentials within a reasonable time period. /quote The approach i used applies salt. It can also pad the password to some standard length, if desired. Though it currently doesn't do that. Slowness of the algo is perhaps a benefit in a way? In my testing it is still fast enough for our use (we are not facebook).