2 ms·
I'd like some sort of "guarantee". I want to sign up on websites that have some sort of seal: "We store passwords according to the XYZ spec". Some combination o
by drivebyacct2 16y ago
I'd like some sort of "guarantee". I want to sign up on websites that have some sort of seal: "We store passwords according to the XYZ spec". Some combination of bcrypt and comprehensive salting. If user data is ever compromised, users recourse to sue. Of course, no site ever do this because users just don't care and it would be a near-valueless liability.
I just don't understand how anyone can store a password in clear text. I have peers in college that couldn't edit the world's simplest VB6 application, but they know not to store passwords in cleartext.
- Jabbles 16y agoJeff Atwood recently wrote about this, making the case for Open Authentication or similar: http://www.codinghorror.com/blog/2010/12/the-dirty-truth-about-web-passwords.html http://www.codinghorror.com/blog/2010/12/the-dirty-truth-abo...
- tptacek 16y agoSo you know: bcrypt is inherently randomized. You don't need to "comprehensively salt" it.
- drivebyacct2 16y ago:) Exactly why someone else would be writing the spec! I know just enough to be dangerous, but meta-fortunately, I'm also aware of that fact.