16 ms·
It was my understanding that hashing and salting is now obsolete, and doesn't really increase security that much. AFAIK, the best 'recommended' way currently is
by misnome 14y ago
It was my understanding that hashing and salting is now obsolete, and doesn't really increase security that much. AFAIK, the best 'recommended' way currently is to use bcrypt.
- sbov 14y agoMy understanding was that bcrypt uses a salt and is a hash.
- carbocation 14y agoIn the same way the US Army consists of a soldier, so too is bcrypt a salt and a hash.
- lockes5hadow 14y agoNo, in fact they are a part of bcrypt, along with other great things.
- UnoriginalGuy 14y agoYour understand is completely wrong. Plus bcrypt is used as a hashing function and includes a salt. So even if what you said was true, it would make bcrypt obsolete. Yes, I know, bcrypt uses a block cipher but block cipher can be easily used for cryptographic hashes (see DES for one example).
- misnome 14y agoYes, bcrypt is used as a hashing function, and includes a salt; but it isn't what is usually meant when "Hashed and salted" are suggested - the salting part becomes part of the algorithm used, rather than something you specifically have to implement yourself. From the perspective of the person using it, it's just a single hash. Saying "Hashing and salting" works is not really any better than what people do already, because, e.g. the passwords in the case discussed in this article WERE hashed and salted, but with a relatively weak hash.