3 ms·
The Cigital-recommended way to hash your passwords is to use an HMAC/scrypt combo, with the HMAC key stored on the app server (not the database). What Linode d
by danielweber 14y ago
The Cigital-recommended way to hash your passwords is to use an HMAC/scrypt combo, with the HMAC key stored on the app server (not the database).
What Linode did may, or may not, be dumb. They are being tight-lipped so we can only guess.
- lawnchair_larry 14y agoWhy would you use an HMAC for password storage? It's not like length extension attacks are relevant in that application.