2 ms·
If you're considering the encryption of passwords and not the hashing and salting of passwords, you're already in some trouble. You don't want to decrypt passw
by Hoff 18y ago
If you're considering the encryption of passwords and not the hashing and salting of passwords, you're already in some trouble.
You don't want to decrypt passwords.
You want to hash, and compare. And only then with a cryptographically secure hash.
And you also want to consider building in some form of evasion, and quite possibly to introduce a deliberate delay in the password processing; steps to slow the inevitable password attacks.
- ScottWhigham 18y agoSeconded. I would add that you should use more than one form of cryptography: one type for sensitive contact information and another for passwords. For internal support you often need to decrypt names, address, email but you don't want that same algorithm for passwords, credit cards, etc.