3 ms·
Isn't that a self-fulfilling prophecy? If you buying into the "just use bcrypt" idea, how will scrypt ever change the fact that it's not widely available on the
by nextparadigms 15y ago
Isn't that a self-fulfilling prophecy? If you buying into the "just use bcrypt" idea, how will scrypt ever change the fact that it's not widely available on the web?
- tptacek 15y agoI addressed this directly downthread. I don't care whether TweetYourCatFood.com uses bcrypt. Specifically, I care that: * It's got a reliable Gem for Ruby * It's got a reliable easy_install package for Python * It's got a good reliable CPAN entry for Perl * It's got a Java jar file from a reputable source * It's got a .NET assembly from a reputable source And what I'm saying is not that scrypt will be "safe to use" when that happens. scrypt is safe to use now; safer, marginally, than bcrypt. What I'm saying is that when that set of things happens, I will personally stop recommending bcrypt and start recommending scrypt. And I only point that out because I always feel a little bad about not recommending scrypt, which is strictly speaking better than bcrypt.