3 ms·

Cryptography is hard and best practice should be to use common libraries to help you get it right.

• cm2187 10y ago
  It's not about writing your own crypto. It's about knowing not to use the md5 library but the bcrypt library instead.
  • tamana 10y ago
    Ideally the md5 library documentation says "this is a digest function, not a secure bash"
    • geocar 10y ago
      Those words might as well be in greek. How about: You should use the md5 function to produce a string you can compare with the md5 function. md5 is obsolete, does not offer much security, and should not be used in new programs except for the purposes of interoperating with old programs, and even in that case, one should weigh the risks of interoperation with the costs of replacing. If you are looking for a suitable replacement for md5, you should instead be looking for specific use-cases, such as content verification (links...), authenticated content verification (links...), password verification (links...), random number generation (links...), shared secret encryption (links...)
      • cm2187 10y ago
        In fact you only want to use it when your comparison can afford collisions (md5 generates a lot of collisions). Sha256 is pretty much collision free.