4 ms·
This still doesn't handle email verification, multiple roles, remember me tokens, and a slew of other features Devise offers. This is really just some Rails su
by michaelfairley 16y ago
This still doesn't handle email verification, multiple roles, remember me tokens, and a slew of other features Devise offers.
This is really just some Rails sugar around bcrypt-ruby.
- swaits 16y agoWhich wasn't that hard to use unsugared. This move also signals to the community that bcrypt is considered a best practice, important enough that it's included by default. Rails benefits from this.
- there 16y agoThis move also signals to the community that bcrypt is considered a best practice, important enough that it's included by default. bcrypt has been considered a best practice for quite a while. it's been openbsd's default password hashing scheme since 1997, and used in a number of php projects like drupal, phpbb, and wordpress for many years.
- swaits 16y agoYup. That hasn't stopped hordes of devs from doing stupid things with passwords. My point is that now, at least for Rails, bcrypt is harder to ignore. And that's a good thing.