2 ms·
Like all the mainstream Linux distributions out there? But seriously, IIRC they do 5000 rounds by default, but I've been wondering for a few years how is it th
by shandor 7y ago
Like all the mainstream Linux distributions out there?
But seriously, IIRC they do 5000 rounds by default, but I've been wondering for a few years how is it that supporting nothing better than SHA512 for the whole /etc/shadow -based system is still ok? How come there's still no support for scrypt or bcrypt?
- tialaramex 7y agoBecause it actually hardly matters at all? It's salted enough that it's not amenable to a time-space optimisation and it's pessimised enough to make trivial attacks impractical so bad guys who have the database will resort to brute force on individual passwords. At which point either you have a good password and they can't guess it or you don't. Fancier schemes are about the margin, can we make it too expensive to brute force say 8 alphanumerics? But you don't need to live in the margins and you shouldn't.