4 ms·
Relatively compared to what? MD5 and SHA1 can be computed very very quickly and can easily be brute forced on GPU clusters. Compared to PBKDF2, bcrypt, and scr
by bascule 14y ago
Relatively compared to what? MD5 and SHA1 can be computed very very quickly and can easily be brute forced on GPU clusters.
Compared to PBKDF2, bcrypt, and scrypt, this system is incredibly insecure and susceptible to brute force attacks.
My opinion of this code is it's full of nonsensical voodoo and this guy has no business writing cryptographic code of any kind.
- Dylan16807 14y agoYou realize how many places use a fast hash for passwords, right? It is nowhere near DailyWTF levels.
- stouset 14y agoThe fact that 95% of sites get it wrong doesn't detract from the fact that this implementation is broken, and trivially susceptible to brute force. If 95% of people believed in demonic possession, we'd all bemoan how crazy, dangerous, and fucked-up the situation is. But when a developer knows the solution recommended by real live cryptographers and chooses to discard it for his own broken version, we shrug our shoulders because, hey, everyone else gets it wrong too. Fuck that. Bad code is bad. Bad developer attitudes are worse.