3 ms·
I wouldn't exactly call "just use bcrypt" a cargo cult. It has had real benefits to the web dev community because it factors down to "don't store it in plain te
by noonespecial 15y ago
I wouldn't exactly call "just use bcrypt" a cargo cult. It has had real benefits to the web dev community because it factors down to "don't store it in plain text or use MD5 or something".
Several people working on small projects have already come to me and asked me "what's this bcrypt thing? should I use it here?" I guarantee these folks would have just stored it plaintext otherwise. So I've directly observed the mantra making stuff safer. Win.
- tptacek 15y agoI strongly agree that when asked by friends what to use, you should think about which library is going to be easier for them to use, and not try to think through which construction is "better". That this blog post gets the real ordering of betterness wrong is tangential to the real problem, which is that it gets the value proposition of bcrypt wrong.