3 ms·
No matter you smart you think you are a bad guy might end up with your user table one day, and on that day you'll hope he can't crack your passwords easily. Yo
by staunch 15y ago
No matter you smart you think you are a bad guy might end up with your user table one day, and on that day you'll hope he can't crack your passwords easily.
You can control how slow bcrypt is by specifying the wok factor variable. In this context "slow" is maybe 100ms to check a password. This shouldn't be a problem on almost any web site.
Use bcrypt.
- PLejeck 15y agoBut I'm wondering, does increasing the work factor actually make the algorithm stronger? Am I still risking bcrypt being cryptographically broken?
- staunch 15y agoIncreasing the work factor makes it slower to check a password, that's all. Your home grown SHA-512 algorithm is more likely to be broken than bcrypt.