4 ms·

The Use bcrypt rant comes up on HN a lot, but I've actually never seen a website that uses bcrypt or PBKDF2 in the real world. Hell, I rarely encounter develope

The Use bcrypt rant comes up on HN a lot, but I've actually never seen a website that uses bcrypt or PBKDF2 in the real world. Hell, I rarely encounter developers or admins who even know what it is. I doubt it was more than md5+salt, but maybe. Edit: I should clarify - there certainly are examples of bcrypt being used, and I know there are tools available. But pick several random websites that have forums or user accounts and the number actually using it will be very small. That has been my experience once exposed to the code/infrastructure anyway.

cheald 15y ago
Any modern Rails app is very likely using bcrypt to store password hashes. It's baked into most of the popular auth frameworks.
- JonnieCache 15y ago
  It's actually now baked into rails itself. You can declare has_secure_password in the model and you're away.
  - lawnchair_larry 15y ago
    Why would you have to declare it?
    - mguillemot 15y ago
      Because it adds a few attributes (like 'password') and methods (like 'authenticate') to your model, and you might not really want such things on every one of your models. Clarification: has_secure_password does NOT mean you choose between secure or non-secure password, it just mean "I want a password on this model, and better make it secure guys!"
chrischen 15y ago
It is extremely easy to use bcrypt. http://www.openwall.com/phpass/ http://www.openwall.com/phpass/
makmanalp 15y ago
Counterexample: I've recently been playing with http://brubeck.io/ http://brubeck.io/ and it uses bcrypt as the default: https://github.com/j2labs/brubeck/blob/master/brubeck/auth.py https://github.com/j2labs/brubeck/blob/master/brubeck/auth.p...
- aidenn0 15y ago
  Wow, that's probably the first web framework I've seen that is more polished than the server it runs on top of; my experience with mongrel2 is that it's still a bit rough around the edges.
ketralnis 15y ago
I can't speak for many, but at least reddit (https://github.com/reddit/reddit/commit/a311805c8598232b14a40a561bb4dc9528e707ee https://github.com/reddit/reddit/commit/a311805c8598232b14a4...), and Hipmunk do
- StavrosK 15y ago
  Happened a bit too late for reddit, though :p
bjg 15y ago
In a lame web service / trivia game I created for a distributed systems graduate class I used bcrypt. https://github.com/bgianfo/distributed-systems https://github.com/bgianfo/distributed-systems
po 15y ago
PBKDF2 will be in Django 1.4: https://code.djangoproject.com/ticket/15367 https://code.djangoproject.com/ticket/15367 edit Let me also add... this is for auth/password hashing, not data encryption. To any people reading this: if you don't understand the difference, and you are responsible for writing web applications, then please read up on it. The data that Valve was storing (CC info) needs to be encrypted and I'm assuming that data then needs to be unencryptable. They have to store the key because they have to be able to recover the plain text. With password hashing, you will never need to be able to recover the password.
- ubernostrum 15y ago
  Also, if you're using Django, consider Playdoh: https://github.com/mozilla/playdoh https://github.com/mozilla/playdoh It's what we use at Mozilla as the basis for most of our Django-based stuff, and gets you bcrypt password hashing -- even on older Django releases -- for free, along with some other niceties that probably need to find their way upstream soon :)
  - Semiapies 15y ago
    Very interesting stuff - thanks!
tptacek 15y ago
We see bcrypt and/or PBKDF2 regularly.
markbao 15y ago
The statement "I've actually never seen a website that uses bcrypt or PBKDF2 in the real world" doesn't discredit the "Use bcrypt[/PBKDF2]" argument, though.
spullara 15y ago
Since it was just as easy as any other way I used bcrypt for my site. Seems common as of a year ago.
RyanMcGreal 15y ago
I administer a community news and public affairs site. Early this year, after reading about bcrypt on hacker news, I witched the site authentication to bcrypt from salted md4 hash. http://raisethehammer.org/blog/2084 http://raisethehammer.org/blog/2084
sp4rki 15y ago
I think you'll probably find a whole lot of examples if you use a dataset of websites, webapps, and desktop/server apps made in the last decade. I work in business and enterprise application development, from simple webapps to complex systems on massive servers and I've been using and evangelizing bcrypt use around my circle for quite some time. At this point, most of the people I've encountered that are in charge of systems needing some type of encryption for their user data use bcrypt. I think most of the decent developers around the world already know of the perils of using weak encryption algorithms.
cipherpunk 15y ago
The company I am with just moved from plaintext in-database password storage to using bcrypt with their latest product release, FWIW. It was either that or I left, heh.

cheald 15y ago

Any modern Rails app is very likely using bcrypt to store password hashes. It's baked into most of the popular auth frameworks.

JonnieCache 15y ago
It's actually now baked into rails itself. You can declare has_secure_password in the model and you're away.
- lawnchair_larry 15y ago
  Why would you have to declare it?
  - mguillemot 15y ago
    Because it adds a few attributes (like 'password') and methods (like 'authenticate') to your model, and you might not really want such things on every one of your models. Clarification: has_secure_password does NOT mean you choose between secure or non-secure password, it just mean "I want a password on this model, and better make it secure guys!"

chrischen 15y ago

It is extremely easy to use bcrypt. http://www.openwall.com/phpass/ http://www.openwall.com/phpass/

makmanalp 15y ago

Counterexample: I've recently been playing with http://brubeck.io/ http://brubeck.io/ and it uses bcrypt as the default: https://github.com/j2labs/brubeck/blob/master/brubeck/auth.py https://github.com/j2labs/brubeck/blob/master/brubeck/auth.p...

aidenn0 15y ago
Wow, that's probably the first web framework I've seen that is more polished than the server it runs on top of; my experience with mongrel2 is that it's still a bit rough around the edges.

ketralnis 15y ago

I can't speak for many, but at least reddit (https://github.com/reddit/reddit/commit/a311805c8598232b14a40a561bb4dc9528e707ee https://github.com/reddit/reddit/commit/a311805c8598232b14a4...), and Hipmunk do

StavrosK 15y ago
Happened a bit too late for reddit, though :p

bjg 15y ago

In a lame web service / trivia game I created for a distributed systems graduate class I used bcrypt. https://github.com/bgianfo/distributed-systems https://github.com/bgianfo/distributed-systems

po 15y ago

PBKDF2 will be in Django 1.4: https://code.djangoproject.com/ticket/15367 https://code.djangoproject.com/ticket/15367 edit Let me also add... this is for auth/password hashing, not data encryption. To any people reading this: if you don't understand the difference, and you are responsible for writing web applications, then please read up on it. The data that Valve was storing (CC info) needs to be encrypted and I'm assuming that data then needs to be unencryptable. They have to store the key because they have to be able to recover the plain text. With password hashing, you will never need to be able to recover the password.

ubernostrum 15y ago
Also, if you're using Django, consider Playdoh: https://github.com/mozilla/playdoh https://github.com/mozilla/playdoh It's what we use at Mozilla as the basis for most of our Django-based stuff, and gets you bcrypt password hashing -- even on older Django releases -- for free, along with some other niceties that probably need to find their way upstream soon :)
- Semiapies 15y ago
  Very interesting stuff - thanks!

tptacek 15y ago

We see bcrypt and/or PBKDF2 regularly.

markbao 15y ago

The statement "I've actually never seen a website that uses bcrypt or PBKDF2 in the real world" doesn't discredit the "Use bcrypt[/PBKDF2]" argument, though.

spullara 15y ago

Since it was just as easy as any other way I used bcrypt for my site. Seems common as of a year ago.

RyanMcGreal 15y ago

I administer a community news and public affairs site. Early this year, after reading about bcrypt on hacker news, I witched the site authentication to bcrypt from salted md4 hash. http://raisethehammer.org/blog/2084 http://raisethehammer.org/blog/2084

sp4rki 15y ago

I think you'll probably find a whole lot of examples if you use a dataset of websites, webapps, and desktop/server apps made in the last decade. I work in business and enterprise application development, from simple webapps to complex systems on massive servers and I've been using and evangelizing bcrypt use around my circle for quite some time. At this point, most of the people I've encountered that are in charge of systems needing some type of encryption for their user data use bcrypt. I think most of the decent developers around the world already know of the perils of using weak encryption algorithms.

cipherpunk 15y ago

The company I am with just moved from plaintext in-database password storage to using bcrypt with their latest product release, FWIW. It was either that or I left, heh.