3 ms·
It's worse than that - I admit I know very little about crypto. So when it comes to implementing a password storage system I read up a bit, get confused, ask a
by rahoulb 16y ago
It's worse than that - I admit I know very little about crypto.
So when it comes to implementing a password storage system I read up a bit, get confused, ask a couple of people and get different answers back.
It's the "get confused" bit that's dangerous. As you say, the differences are quite subtle and (for me at least) when they are being explained make perfect sense, but ten minutes later have become an uncrackable cipher all of their own.
- ZoFreX 16y agoI'm not sure what advice to give you. You commonly see advice to outsource your security, to other libraries, the idea being these are more likely to be correct than you. However, there have been some pretty high profile mistakes in common crypto libraries too! If there's anything specific you have in mind, I'd be happy to field questions (and hopefully other HN users will correct me in the event I'm wrong!)
- rahoulb 16y agoCheers (that's why I love this place). At the moment I use Authlogic in Rails, which uses SHA512 by default (SHA512 is built into the Ruby core libs). But I also notice that it's quite easy to switch to bcrypt (using the bcrypt gem). Is it worth switching? Or at least using that as my default on new apps?
- ZoFreX 16y agoWhat is it being used for, and how is it being used? I'm guessing this is password hashes. Is rails using a unique salt for each password? Bcrypt is slower than SHA512, in fact it can be made to be very slow. This is actually ideal for password hashes, it doesn't matter if it takes your server 50 milliseconds to calculate a password hash but that would severely slow down an attack. It is important however that they are being used correctly. Either would be a good solution if properly salted.