4 ms·
And we should all use bcrpyt to hash password. We all should have had it long long time ago, and people are still rolling out their own password hashing with sa
by stevefan1999 7y ago
And we should all use bcrpyt to hash password. We all should have had it long long time ago, and people are still rolling out their own password hashing with salting mechanism. Biggest facepalm in the industry in my eyes.
- blattimwind 7y agonot processing plaintext passwords on your server >> argon > scrypt > bcrypt > pbkdf2 >>> any hash
- CaptainMarvel 7y agoThere is an algorithm to authenticate without sharing the plaintext password from client to server, nor server to client - SRP. I know Apple uses it.
- ris 7y agoUnless any of your users ever try and use a >72 character password.
- masklinn 7y agoTBF that's super easy to work around: just prehash the key. In fact, an other risk of bcrypt is that any nul byte will truncate the key, so you probably want to hash the password with something else (SHA384 or SHA512/256 for instance) then base64/base85-encode it before passing it to bcrypt.