5 ms·
"Prepend the salt to the password and hash it with a standard cryptographic hash function such as SHA256." No! At the very least, you ought to be using an HMA
by jemfinch 14y ago
"Prepend the salt to the password and hash it with a standard cryptographic hash function such as SHA256."
No! At the very least, you ought to be using an HMAC.
- pjscott 14y agoThat's potentially dangerous advice, because as it may lead someone to use an HMAC and think themselves safe, instead of using something like Bcrypt that's slow enough to foil brute force attacks.