3 ms·
As stated in the article, a popular stance on Hacker News and Stack Overflow is "USE BCRYPT". It's chanted to crypto-noobs and webdevs as a simple-to-use librar
by lhnn 15y ago
As stated in the article, a popular stance on Hacker News and Stack Overflow is "USE BCRYPT". It's chanted to crypto-noobs and webdevs as a simple-to-use library for password storage that is more secure than MD5/SHA/Whatever hashing, and with built-in salts.
The whole point of this article is to say that, in fact, there are other options.
- deleted 15y ago[deleted]
- cperciva 15y agoWith a few very rare exceptions, those use cases are equivalent. EDIT: The context was comparing 1. converting passwords into keys for cryptographic purposes and 2. hashing passwords to be used for logins.
- tptacek 15y agoBullshit. There is one very-well-written article at Coda Hale's site that says "just use bcrypt", but in discussions of adaptive hashing on HN, people who know what they're talking about are continuously at pains to vouch for PBKDF2 and scrypt (it helps that one of the people who knows what they're talking about on this subject is (a) vocal on HN and (b) designed scrypt). It irritates me that despite going through the effort of vouching for PBKDF2 and scrypt every time this f'ing topic comes up on HN, people still manage to reduce this issue to another tribal conflict. And who are these "crypto noobs" you speak of?
- funkah 15y agoRaises hand It's important to know what you don't know. And I know enough about crypto to know that I don't know anything and should listen to people who do.
- lhnn 15y agoI'm one of those crypto-noobs. I'm getting better and studying, and obviously hanging out on Stack Exchange. I didn't make it a tribal conflict. If anything, the article did... I was summarizing. I must have missed the part where scrypt was mentioned here, but I have seen it called out on SE.
- there 15y agoThe whole point of this article is to say that, in fact, there are other options. Then maybe it shouldn't have such an inflammatory title as "Don't use bcrypt". "Alternatives to bcrypt", perhaps.
- lhnn 15y agoI agree with you there. I only let it pass my personal bullshit-ometer because it's a rebuttal to a popular article titled "use bcrypt".