5 ms·
Are you using salts, and what hash algo are you using? For a security comment on DIY I'd hope that you be more specific as I don't want somebody reading it and
by sammorrowdrums 7y ago
Are you using salts, and what hash algo are you using? For a security comment on DIY I'd hope that you be more specific as I don't want somebody reading it and thinking they can just MD5 passwords with no salt and expect their system to be safe...
- vbezhenar 7y agoI'm using salt for every password with PBKDF2WithHmacSHA256 algorithm. It's an old algorithm, but it's not broken and it's supported in Java without any additional crypto libraries. I think that modern alternatives are bcrypt, scrypt and argon 2.
- sammorrowdrums 7y agoThanks for that, I agree simple password authentication doesn't require a library, but there are still pitfalls and mistakes so I don't mind encouraging libraries as at least there is (for the popular libs) some responsibility taken for quality of implementation, and things like password reset mechanisms etc. As you mention handling multiple Oauth providers and stuff that is usually not worth the effort without a library, but anyway. Just looking out for people like the younger me (who would probably have tried to roll out things they shouldn't have, naively).