3 ms·
> MD5 is known to be very insecure and you should never use it for real world password hashing. Instead, you would use SHA-512, SHA3 or another highly secure al
by SAI_Peregrinus 6y ago
> MD5 is known to be very insecure and you should never use it for real world password hashing. Instead, you would use SHA-512, SHA3 or another highly secure algorithm.
No, you should use a (poorly named) "password hashing algorithm" which has different security properties from normal cryptographic hash functions.
Later on they indicate that they're using PBKDF2-HMAC-SHA512, which is outdated and not as good as scrypt or bcrypt, both of which are offered in the pycryptodome library they're using. The only reason to use PBKDF2 is for backwards compatibility, or with systems that don't offer better (memory-hard or cache-hard) algorithms. The documentation even states "New applications and protocols should use scrypt or bcrypt instead."[1]
Hardly ultra-secure. They didn't even bother reading the docs of the crypto library they used.
[1] https://www.pycryptodome.org/en/latest/src/protocol/kdf.html https://www.pycryptodome.org/en/latest/src/protocol/kdf.html
- tubbyjr 6y agoThe architecture is convoluted and they couldn't even be arsed to read or understand the crypto they were using, so if they failed at that implementation why believe they didn't leave holes in such a complex architecture setup. I'd prefer simple and reliable. It seems like infra playboys trying to make crypto. Go ahead and make stuff like this, it's great, but don't call it "Ultra Secure". A more apt description would be "Completely unproven and experimental while built on crypto primitives approaching obsolescence".
- aesh2Xa1 6y agoWhat's an infra playboy?
- SAI_Peregrinus 6y agoProbably short for "infrastructure playboy", I suspect they're thinking of the sort of person who tries to make a text editor starting from a k8s cluster out of containers running in VMs on AWS.
- ratdragon 6y agoLove your definition. This goes to urban dictionary :-)