4 ms·

Everyone should be salting and hashing correctly - it's trivially easy to implement and the cost is trivial. However, once the user database is stolen in its en

by casca 13y ago

Everyone should be salting and hashing correctly - it's trivially easy to implement and the cost is trivial. However, once the user database is stolen in its entirety, there are other factors that become as important: - Did the user use a common passwords? If they did, then it will quick to brute-force. - Did the user reuse the same credentials on other sites? If they did then the value of recovering the password becomes worth plowing through well-salted scrypt. The real problem is that far too many people use the same credentials for LivingSocial and their Gmail.

misnome 13y ago
It was my understanding that hashing and salting is now obsolete, and doesn't really increase security that much. AFAIK, the best 'recommended' way currently is to use bcrypt.
- sbov 13y ago
  My understanding was that bcrypt uses a salt and is a hash.
  - carbocation 13y ago
    In the same way the US Army consists of a soldier, so too is bcrypt a salt and a hash.
- lockes5hadow 13y ago
  No, in fact they are a part of bcrypt, along with other great things.
- UnoriginalGuy 13y ago
  Your understand is completely wrong. Plus bcrypt is used as a hashing function and includes a salt. So even if what you said was true, it would make bcrypt obsolete. Yes, I know, bcrypt uses a block cipher but block cipher can be easily used for cryptographic hashes (see DES for one example).
  - misnome 13y ago
    Yes, bcrypt is used as a hashing function, and includes a salt; but it isn't what is usually meant when "Hashed and salted" are suggested - the salting part becomes part of the algorithm used, rather than something you specifically have to implement yourself. From the perspective of the person using it, it's just a single hash. Saying "Hashing and salting" works is not really any better than what people do already, because, e.g. the passwords in the case discussed in this article WERE hashed and salted, but with a relatively weak hash.

by casca 13y ago

misnome 13y ago

It was my understanding that hashing and salting is now obsolete, and doesn't really increase security that much. AFAIK, the best 'recommended' way currently is to use bcrypt.

sbov 13y ago
My understanding was that bcrypt uses a salt and is a hash.
- carbocation 13y ago
  In the same way the US Army consists of a soldier, so too is bcrypt a salt and a hash.
lockes5hadow 13y ago
No, in fact they are a part of bcrypt, along with other great things.
UnoriginalGuy 13y ago
Your understand is completely wrong. Plus bcrypt is used as a hashing function and includes a salt. So even if what you said was true, it would make bcrypt obsolete. Yes, I know, bcrypt uses a block cipher but block cipher can be easily used for cryptographic hashes (see DES for one example).
- misnome 13y ago
  Yes, bcrypt is used as a hashing function, and includes a salt; but it isn't what is usually meant when "Hashed and salted" are suggested - the salting part becomes part of the algorithm used, rather than something you specifically have to implement yourself. From the perspective of the person using it, it's just a single hash. Saying "Hashing and salting" works is not really any better than what people do already, because, e.g. the passwords in the case discussed in this article WERE hashed and salted, but with a relatively weak hash.