5 ms·
Which means that they're not using bcrypt, which means they still have no idea what they're talking about and are probably insecure.
by Locke1689 15y ago
Which means that they're not using bcrypt, which means they still have no idea what they're talking about and are probably insecure.
- tedunangst 15y agoThey could be using PBKDF2, but if they were, they probably should have said the magic words. Also, the iteration count is kind of important. If it's triple-iterated, that won't do much good.
- zachanker 15y agoEven with the iteration count, SHA512 is not exactly meant to be slow. They're taking the long way around to try and get the security of bcrypt... without just using bcrypt.
- davidhollander 15y ago> Even with the iteration count, SHA512 is not exactly meant to be slow. Increasing iteration count is synonymous with intending something to be slow. BCrypt itself uses a default of 2^10 iterations in most bindings. PBKDF2 + and an NIST studied hashing algo like SHA512 is a perfectly valid method.
- chalst 15y agoIteration is valid, but what is this about "triple salting"? Googling "triple salted" sha -gox gives me 13 results, of which 3 are about caramel cupcakes and none are serious evaluations of such an approach. It sounds like homebrew security.
- JonnieCache 15y agoI can't see how it could mean anything at all. Your password is either salted or it isn't, a hash can't really be said to have multiple salts. Maybe they're using different salts in their various rounds of hashing, can't see how that would provide any more security.