3 ms·
It looks like an assumption, and a poor one at that. I'm certainly no security expert, and the danger here is almost absurdly obvious. That said - the article
by wyattpeak 11y ago
It looks like an assumption, and a poor one at that. I'm certainly no security expert, and the danger here is almost absurdly obvious.
That said - the article addresses the claimed advantage of storing the value:
"The rationale was that as technology progressed and password cracking became easier, users could be contacted to update their password."
- amjo324 11y ago"The rationale was that as technology progressed and password cracking became easier, users could be contacted to update their password." I would argue that this a misguided motivation for storing the password entropy. Bcrypt is purposefully designed to combat the problem of more efficient brute-forcing due to future GPU/CPU speed improvements by incorporating a 'work factor'. At any time, application owners can specifically increase the work factor and the hashing process will be intentionally slowed further. In this way, the future reversibility of the password hashes can be reduced without requiring that users update their passwords.