3 ms·

See also "A Popular Password Hashing Algorithm Starts Its Long Goodbye": * https://www.wired.com/story/bcrypt-password-hashing-25-years/ https://www.wired.com/

• tptacek 3y ago
  It's weird to see people saying that Bcrypt's "moment is passing", because it isn't. The whole concept of adaptive hashing is that they're future-proofed: they're parameterized by the degree of pain they inflict on brute force guessers, and they take advantage of the imbalance between guessers and validators. Argon2 and scrypt do this more efficiently than Bcrypt (which in turn does this substantially more efficiently than PBKDF2, which is still widely used, in part because there are regs that lock it into place), but you can more or less throw a dart at any of these algorithms to competently choose a password hash. What I understand Niels to be saying here is that passwords are nearing the end of the road. I see why people think that! But it's also been an annual prediction since the 1990s, so I'm a bit skeptical.
  • ycombinete 3y ago
    2023 will be the year of the password-less Linux desktop