4 ms·
This used to be a question on the Triplebyte interview almost verbatim, and a huge percentage of (even quite good) engineers got it wrong. I'd say probably <20%
by rachofsunshine 2y ago
This used to be a question on the Triplebyte interview almost verbatim, and a huge percentage of (even quite good) engineers got it wrong. I'd say probably <20% both salted and used a cryptographically-secure hash; MD5 specifically came up all the time. And keep in mind that we filtered substantially before this interview, so the baseline is even worse than that!
- rjh29 2y agoDamn. Using salts and avoiding MD5 in favour of SHA-1 was well known even around 2005. Rainbow tables were a thing even then.
- Cthulhu_ 2y agoHow are people still learning about basic MD5 for security twenty years later? Are the resources people use that old?
- wildrhythms 2y agoProbably because a lot of computer science programs are stuck in 90s era curricula and many don't teach web development whatsoever.
- Tainnor 2y agoUsing pure SHA for passwords is almost equally bad as MD5, because the biggest problem with these algorithms is their speed (MD5 is completely broken when it comes to collision resistance, of course, but that's not the main concern with passwords). Instead, you should use functions like bcrypt or PBKDF2, which are purposefully built for passwords.