3 ms·
That doesn't really make it any better. If someone gets their database, they almost certainly also have the key they hypothetically encrypted the passwords with
by lucian1900 14y ago
That doesn't really make it any better. If someone gets their database, they almost certainly also have the key they hypothetically encrypted the passwords with.
If they'd used pbkdf/bcrypt or even better, scrypt, this would be a non-issue.
- buttscicles 14y agoI'm curious - what makes scrypt superior to bcrypt?
- lucian1900 14y agoIn addition to being time-hard (like pbkdf2 and bcrypt), it is also space-hard.
- SoftwareMaven 14y agoThe space-hard is important for people throwing 10000 GPU cores at the problem. Bcrypt is more susceptible as it was designed before the million-core world came about; scrypt will continue to thwart due to memory constraints.