3 ms·
> The effort to create and maintain a "secure" one-off credential storage system seems like a waste given the availability of well-tested, accepted methods of c
by lazyjones 14y ago
> The effort to create and maintain a "secure" one-off credential storage system seems like a waste given the availability of well-tested, accepted methods of credential hashing and storage.
I disagree, because what seems safe today might be unsafe tomorrow or in 10 years. Does anyone still remember Unix versions without a shadow passwd file? I do ... But why do we use that even today when modern Linux installations use SHA variants by default?
- marshray 14y agoBecause 50% of typical users will choose one of the top 10,000 most-common passwords and no practical amount of work factor will save them if the hashes become known.
- lazyjones 14y agoConsequently, DB column permissions are also worth it because they hide the hashes, while such people are not protected at all by current hashing schemes. The Postgres function written to compare passwords/hashes can also limit the number of checks per time unit to prevent brute-forcing.