4 ms·
That is fair enough and all your points were very good. However despite the down votes and everything else I stand by what I said. As a user I doubt most devs a
by derrickpetzold 15y ago
That is fair enough and all your points were very good. However despite the down votes and everything else I stand by what I said. As a user I doubt most devs are as competent as the ones here and I would never trust a site with a password that I depend on. Do that there would need to be third-party auditing to make sure that they adhere to the standards you described.
I guess what I am really trying to say is that the state of web/Internet security is very poor right now and I don't believe bcrypt is worthy pursuit (sorry I am really not trying to troll). Since Mt.Gox was just hacked my salted password is on pastebin and then someone attempted to break into my gmail account but that will never happen because I use two factor authentication.
Maybe that is the best solution to all of this.
- caf 15y agoWhile it is certainly a good idea, as a user, to assume that the site developers have done things wrong (and therefore choose a strong, random, unique password), it is also a good idea, as a site developer, to assume that your users are doing things wrong (and therefore choose a strong password hashing method).
- derrickpetzold 15y agoSecurity through obscurity is never a good idea because it leaves a false sense of security. I know I am getting totally destroyed here by the down voting and I'll probably end up in negative karma for this but I standby all of it.
- caf 15y agoI am not advocating security through obscurity. I am saying that your advice is appropriate for users (who cannot control what the server does) but inappropriate for servers (who cannot control what the user does).