3 ms·

While SSHA2 isnt that bad if they’ve applied a work factor, but that’s probably not the case.

• shawn 8y ago
  It's probably better to list what the real solution is: Bcrypt or scrypt. https://www.npmjs.com/package/bcrypt https://www.npmjs.com/package/bcrypt I also added it to a fork of Arc that I'm managing. https://github.com/shawwn/arc3.2/tree/ln/src/bcrypt https://github.com/shawwn/arc3.2/tree/ln/src/bcrypt (Just type `make` and then run Arc like usual. Which is `racket -f as.scm`.) Thanks to Scott Bell for providing code examples of how to use the racket FFI interface and unix crypt function, and for glancing over the finished code. That leaves the question of what an appropriate bcrypt work factor is. 10 is apparently about right.
• tprynn 8y ago
  It doesn't matter what algorithm you use to hash passwords when users login if you also store them md5-ed somewhere else!
  • wyldfire 8y ago
    Tsk, but this was an upgrade from the old log that stored the first three letters of the passphrase. ;)