4 ms·

I wonder, why do people saying "just use bcrypt" never, ever bother to elaborate on what benefits it has, and which of them are relevant to the subject of the c

by romaniv 14y ago

I wonder, why do people saying "just use bcrypt" never, ever bother to elaborate on what benefits it has, and which of them are relevant to the subject of the conversation? Believing in some function without understanding implications of its use does very little for real security.

dchest 14y ago
Because the answer to your question is one Google search away. HN people are tired of explaining it every single time bcrypt comes up.
- Symmetry 14y ago
  Also, there's already an answer in the thread http://news.ycombinator.com/item?id=4073839 http://news.ycombinator.com/item?id=4073839
  - romaniv 14y ago
    It's not an in-depth answer. It does not say, for example, why bcrypt is more secure than nested SHA1. (I believe it has to do with the possibility to efficiently implement SHA algorithms in GPUs.) People are using unsalted SHA1, because someone told them in the past "just use sha1". Now someone else tells them "just use BCrypt". Without understanding why, it's nearly impossible to to decide which security policy is sensible. There are many different types of advice competing for attention, and not all of them are good.
    - tptacek 14y ago
      Somebody once said fire was composed of phlogistons. Later, different people said that fire was instead a process of decomposing fuel molecules and a release of visible light due to the energy of the chemical chain reactions taking place inside the flame. The guy who said "phlogistons" was wrong. So was "just use SHA1" guy.
pbreit 14y ago
http://lmgtfy.com/?q=%22use+bcrypt%22 http://lmgtfy.com/?q=%22use+bcrypt%22
pjscott 14y ago
Bcrypt does not require your understanding. The most important thing is that you use a strong password hashing method -- of which bcrypt is the best-known, and an excellent choice. For a basic level of understanding, here's a slightly exasperated blog post that a lot of people link to: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
sophacles 14y ago
I wonder why people who make this complaint never ever bother to google: "why use bcrypt". It's like they somehow forget they have the best magical oracle to answer questions at their fingertips, which can answer the question better than most people who understand bcrypt could.

by romaniv 14y ago

dchest 14y ago

Because the answer to your question is one Google search away. HN people are tired of explaining it every single time bcrypt comes up.

Symmetry 14y ago
Also, there's already an answer in the thread http://news.ycombinator.com/item?id=4073839 http://news.ycombinator.com/item?id=4073839
- romaniv 14y ago
  It's not an in-depth answer. It does not say, for example, why bcrypt is more secure than nested SHA1. (I believe it has to do with the possibility to efficiently implement SHA algorithms in GPUs.) People are using unsalted SHA1, because someone told them in the past "just use sha1". Now someone else tells them "just use BCrypt". Without understanding why, it's nearly impossible to to decide which security policy is sensible. There are many different types of advice competing for attention, and not all of them are good.
  - tptacek 14y ago
    Somebody once said fire was composed of phlogistons. Later, different people said that fire was instead a process of decomposing fuel molecules and a release of visible light due to the energy of the chemical chain reactions taking place inside the flame. The guy who said "phlogistons" was wrong. So was "just use SHA1" guy.

pbreit 14y ago

http://lmgtfy.com/?q=%22use+bcrypt%22 http://lmgtfy.com/?q=%22use+bcrypt%22

pjscott 14y ago

Bcrypt does not require your understanding. The most important thing is that you use a strong password hashing method -- of which bcrypt is the best-known, and an excellent choice. For a basic level of understanding, here's a slightly exasperated blog post that a lot of people link to: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/

sophacles 14y ago

I wonder why people who make this complaint never ever bother to google: "why use bcrypt". It's like they somehow forget they have the best magical oracle to answer questions at their fingertips, which can answer the question better than most people who understand bcrypt could.