4 ms·
Theres always will exist an option of having more security, than whatever is already providing by any system. That brings up the question: when, choosing to no
by z92 11y ago
Theres always will exist an option of having more security, than whatever is already providing by any system.
That brings up the question: when, choosing to not include more security, isn't considered a bug?
- toolz 11y agoNot sure where the line is drawn, but it's definitely inclusive of the more secure option when it can be implemented in <10 LoCs of code simple enough 99% of the professional dev community can write it.
- Vendan 11y agoEven worse, using an actual password hashing lib, i.e. golang.org/x/crypto/bcrypt, is usually going to take care of it for you. 2 lines of code, 1 to make the hash when the password changes, 1 to check if the password matches the hash, and you are done!(as the library already generates and includes random salts in the hash for you)