4 ms·
To be fair to the author, the paragraph immediately following that code snippet says: "However, this approach has several flaws and should not be used. It is g
by m_sahaf 9y ago
To be fair to the author, the paragraph immediately following that code snippet says:
"However, this approach has several flaws and should not be used. It is given here only to illustrate the theory with a practical example. The next section explains how to correctly salt passwords in real life."
and goes on to use bcrypt.
- jszymborski 9y agoThe fear is that people won't read that or just use the SHA256 example because it's before the bcrypt one, or maybe because they find it runs faster. IMHO, I think examples of dangerous code should implement one of the following mindless-script-kiddie-consultant defenses (in order of most sane to least sane): 1. use screenshots of the snippet 2. use pseudo-code 3. put in deliberate syntax mistakes 4. have a javascript alert on right-click or ctrl/cmd+c with the warning about it being unsafe (a.k.a. going full 90s)
- ams6110 9y agoYes the problem with "unsafe" examples is that people will use them -- perhaps thinking, "this is a POC, we'll come back later and do this properly" -- only it gets forgotten and ends up in production.
- bascule 9y agoTo be fair to the person you're responding to, do you think people looking for copypasta are going to check the fine print? The code sample in question is in no way clearly labeled as being problematic, and a tiny statement buried in a large body of text does not change that fact.
- paulddraper 9y agoTo be fair to the person you are responding to, I don't think copypasta developers are going to create secure applications anyway.
- rakoo 9y agoWhich is exactly why the only copy-paste-able code should be secure by default. Much like the idea behind the existence of NaCl, the easiest thing to do should be the correct thing to do.