3 ms·

I would be impressed if SO's user password table is in bcrypt.

• dhritzkiv 7y ago
  What makes you say that? bcrypt's been the defacto best practice for user password "storage" for probably 10 years now. MD5's been known to be inadequate for much longer. Even if they had a legacy implementation in MD5, gradually migrating from storing MD5 hashes to storing bcrypt hashes is trivial to do.
  • bredren 7y ago
    From what I understand, many systems do not choose to implement strong hashing algos.
    • cyphar 7y ago
      Even PHP's hash_function uses scrypt. Yes, some people explicitly decide to hash everything with sha1 but nothing you or I do will ever be able to stop them.
• gpvos 7y ago
  I would be disappointed if such a high-profile and technically savvy site would be using anything less.