3 ms·
Tangentially related to this: Is storing passwords actually hard, or is it knowing know to do things like this that is? I've seen a lot of people on HN talk ab
by jjice 5y ago
Tangentially related to this: Is storing passwords actually hard, or is it knowing know to do things like this that is?
I've seen a lot of people on HN talk about how they never store passwords because they don't want the liability, and I've seen some talk about how they do since it's simple. In my experience, hashing with Argon2 and keeping that in the DB (for toy personal projects) has been very easy, especially to how scary keeping passwords seems to have been made.
I guess my real question is: If I'm hashing with an actual password acceptable hash method (salt and all), is there any reason I shouldn't still do this? I'm legitimately interested, because for all I know, I'm experiencing the Dunning-Kruger effect.
- web007 5y agoMostly A. Why bother with ever getting a password and having to deal with it in any way, versus delegating that aspect of security to a FAANG-level company with a > $1m security budget? You can store your password yourself, sure, but how certain are you that you're doing it "right" and that "right" today will be good enough tomorrow? 15 years ago MD5 wasn't perfect, but it was good enough versus the other common/stupid methods of storing the password directly or storing it encrypted vs hashed. How certain are you that Argon2 is going to stand the test of time for another couple decades?