4 ms·
Why the DB coudln't do the hashing itself? Storing is the actual dangerous from a security perspective, plain passwords themselves just hitting your db or your
by hartator 10y ago
Why the DB coudln't do the hashing itself? Storing is the actual dangerous from a security perspective, plain passwords themselves just hitting your db or your web apps is fine as long you don't keep a log anywhere in plain.
- danneu 10y agoYou'd want to distribute the load of your slow password-hashing functions across your application servers rather than centralizing it in your single database.
- icebraining 10y agoYou can have more than on database node as well.
- rpedela 10y agoPostgres bcrypt is wicked fast. You need some crazy load before it makes sense to move hashing out of the DB.
- Xylakant 10y agoIf your PW hashing function is wicked fast, you need to increase the work factor. The whole idea of a paw hash is to be comparatively slow, because that's one property that makes it harder to crack. Otherwise we could all go back to salted md5
- jeltz 10y agoPlease change to a higher factor. PostgreSQL's default is a bit outdated and too low for modern computers.